# stream-chat: tokens can only be created server-side using the API Secret (Next.js API route)

In a Next.js API route (server-side code), calling `client.createToken(userId)` on a client from `StreamChat.getInstance(process.env.STREAM_KEY, process.env.STREAM_SECRET)` throws `Error: tokens can only be created server-side using the API Secret`, even though the secret is passed. The key and secret env vars are correctly set, and the reporter confirmed they are read properly. The client instance reports `secret value == undefined` despite the secret being passed to getInstance.

## How to handle it

`StreamChat.getInstance()` is a singleton: it creates the client only on the first call in the runtime, and later calls with different parameters are ignored. If the client was first initialized anywhere without the secret (e.g. client-side code), the shared instance has `secret value == undefined` and token creation throws. Fix: use `new StreamChat(apiKey, apiSecret)` in your API route instead of `getInstance`, which always creates a fresh instance with the credentials you pass. The maintainer confirmed this is the correct approach when you need different instances/key-secrets.
Source: https://github.com/GetStream/stream-chat-js/issues/665