Server-only modules in NextJS - Step-by-Step Execution

Concept Flow - Server-only modules

Import server-only module

↓

Code runs on server

↓

Server-only code executes

↓

No client bundle inclusion

↓

Server sends data to client

↓

Client renders with server data

Server-only modules are imported and run only on the server, never sent to the browser, ensuring secure and efficient code separation.

Execution Sample

NextJS

import { getSecretData } from './server-only';

export default function Page() {
  const data = getSecretData();
  return <div>{data}</div>;
}

This code imports a server-only module and uses its data inside a React component rendered on the server.

Execution Table

Step	Action	Module Loaded	Execution Context	Result
1	Import server-only module	server-only.js	Server	Module loaded successfully
2	Call getSecretData()	server-only.js	Server	Returns secret data string
3	Render Page component	N/A	Server	HTML with secret data generated
4	Send HTML to client	N/A	Server	Client receives rendered HTML
5	Client renders component	N/A	Client	Displays secret data (no server code included)

💡 Execution stops after client renders; server-only code never runs or appears on client.

Variable Tracker

Variable	Start	After Step 2	After Step 3	Final
data	undefined	"Top secret info"	"Top secret info"	"Top secret info"

Key Moments - 2 Insights

Why doesn't the server-only module code appear in the client bundle?

Because server-only modules run only on the server and Next.js excludes them from client bundles, as shown in execution_table step 1 and 5.

Can client-side code call functions from server-only modules?

No, client-side code cannot call server-only functions directly; they only receive the rendered output or data from the server, as seen in step 5.

Visual Quiz - 3 Questions

Look at the execution table, at which step is the server-only module first loaded?

A Step 3

B Step 1

C Step 5

D Step 2

💡 Hint

Check the 'Module Loaded' and 'Execution Context' columns in the execution_table.

According to variable_tracker, what is the value of 'data' after step 2?

A undefined

B null

C "Top secret info"

D empty string

💡 Hint

Look at the 'After Step 2' column for variable 'data' in variable_tracker.

If the server-only module was accidentally imported in client code, what would happen?

A Build would fail or client bundle would include server code

B Code runs normally on client

C Server-only code runs twice

D Nothing changes

💡 Hint

Recall that server-only modules are excluded from client bundles as per execution_table step 1 and 5.

Concept Snapshot

Server-only modules in Next.js:
- Imported only in server code
- Never included in client bundles
- Used for secure or heavy logic
- Server runs module, sends data to client
- Client renders without server code

Full Transcript

Server-only modules in Next.js are special files imported only on the server side. When you import such a module, Next.js ensures it runs only on the server and is not sent to the browser. This keeps sensitive code safe and reduces client bundle size. In the example, the server-only module is imported and called during server rendering. The server generates HTML with the secret data and sends it to the client. The client displays the data but never runs or sees the server-only code. This separation is clear in the execution steps and variable tracking. Beginners often wonder why server code is not in the client bundle or if client code can call server-only functions. The answer is no, client code only receives rendered output or data from the server. If server-only modules are mistakenly imported in client code, the build will fail or include unwanted code. This visual trace helps understand how Next.js handles server-only modules safely and efficiently.

Practice

1. What is the main purpose of server-only modules in Next.js?

easy

A. To enable server code to be bundled with client JavaScript

B. To run code on both server and client for faster rendering

C. To allow client-side code to access server secrets directly

D. To run code only on the server and keep it hidden from the browser

Solution

1. Step 1: Understand server-only module purpose

   Server-only modules run exclusively on the server and are not sent to the browser.

2. Step 2: Identify security benefit

   This keeps secrets safe and improves app security by hiding sensitive code from clients.

3. Final Answer:

   To run code only on the server and keep it hidden from the browser -> Option D

4. Quick Check:

   Server-only modules hide code from browser = A [OK]

Hint: Server-only means code runs only on server, hidden from browser [OK]

Common Mistakes:

• Thinking server-only modules run on client too
• Assuming server-only modules expose secrets to browser
• Confusing server-only with shared server-client code

2. Which line correctly marks a Next.js module as server-only?

easy

A. export const client = true;

B. export const runtime = 'edge';

C. import 'server-only';

D. export default function ServerOnly() {}

Solution

1. Step 1: Recall server-only marking syntax

   Next.js uses import 'server-only'; to mark server-only modules.

2. Step 2: Compare options

   import 'server-only'; matches the correct syntax; others either mark edge runtime or client code.

3. Final Answer:

   import 'server-only'; -> Option C

4. Quick Check:

   Server-only marker = import 'server-only' [OK]

Hint: Look for import 'server-only' to mark server-only [OK]

Common Mistakes:

• Using 'edge' runtime which is for edge functions, not server-only
• Confusing client export with server-only marking
• Missing the import keyword

3. Given this server-only module code in Next.js, what will happen if you try to import it in a client component?

import 'server-only';

export function secretData() {
  return 'top-secret';
}

medium

A. The client component will fail to compile with an error

B. The client component will receive the secret data as a string

C. The secretData function will run on the client without errors

D. The secretData function will be bundled into client JavaScript

Solution

1. Step 1: Understand server-only import restrictions

   Server-only modules cannot be imported into client components; Next.js blocks this to protect secrets.

2. Step 2: Predict behavior on import

   Trying to import causes a compile-time error because the module is not allowed in client code.

3. Final Answer:

   The client component will fail to compile with an error -> Option A

4. Quick Check:

   Importing server-only in client causes error = D [OK]

Hint: Server-only modules cannot be imported by client components [OK]

Common Mistakes:

• Assuming server-only code runs on client
• Thinking secret data is exposed to client
• Believing server-only modules are bundled with client code

4. You wrote this server-only module but get an error when running your Next.js app:

export function getSecret() {
  return 'hidden';
}

What is missing to make this module server-only?

medium

A. You need to add import 'server-only'; at the top

B. You must rename the function to start with 'server'

C. You should import React in this module

D. You need to export the function as default

Solution

1. Step 1: Identify server-only module requirement

   Next.js requires import 'server-only'; to mark a module as server-only.

2. Step 2: Check given code

   The code lacks this import, so Next.js treats it as shared or client code, causing errors if used improperly.

3. Final Answer:

   You need to add import 'server-only'; at the top -> Option A

4. Quick Check:

   Missing 'server-only' import causes error = A [OK]

Hint: Always add import 'server-only'; to mark server-only [OK]

Common Mistakes:

• Thinking function name controls server-only status
• Assuming React import is needed for server-only modules
• Believing default export affects server-only behavior

5. You want to fetch a secret API key only on the server in Next.js and prevent it from being sent to the client. Which approach correctly uses server-only modules to achieve this?

// secret.js
import 'server-only';
export function getApiKey() {
  return process.env.API_KEY;
}

// page.jsx
'use client';
import { getApiKey } from './secret';

export default function Page() {
  const key = getApiKey();
  return <p>API Key: {key}</p>;
}

hard

A. This code will cause an error because getApiKey is called in a client component

B. You should move getApiKey call inside a server component or server action

C. This code works and safely shows the API key on the client

D. You must export getApiKey as default to work

Solution

1. Step 1: Understand server-only module usage

   Server-only modules cannot be imported or called directly in client components without error.

2. Step 2: Analyze the code

   The page.jsx is a client component calling getApiKey(), which is server-only, causing an error.

3. Step 3: Correct approach

   Call getApiKey() inside a server component or server action to keep the secret on the server.

4. Final Answer:

   You should move getApiKey call inside a server component or server action -> Option B

5. Quick Check:

   Server-only calls must be inside server components = B [OK]

Hint: Call server-only functions only inside server components or actions [OK]

Common Mistakes:

• Calling server-only functions directly in client components
• Exposing secrets by rendering them in client JSX
• Assuming default export fixes server-only usage