Your Next.js API route is public—even if your UI isn’t.

Protect a Next.js App Router contact endpoint with self-hosted FCaptcha, server-only secrets and fail-closed verification.