maybe you can try : Use getToken instead of getServerSession: Try using getToken to manually retrieve the token from the request, as getServerSession may return null in API routes without a valid token.

Configure NEXTAUTH_SECRET: Ensure that NEXTAUTH_SECRET is correctly set in environment variables, as it’s required for token verification in API routes.

Set Session Strategy to jwt: In your next-auth options, make sure session: { strategy: "jwt" } is set, especially for credential-based authentication.

If none of this help, u better get some pen and paper to go through all the steps one by one.