diff --git a/.devcontainer/docker-compose.yml b/.devcontainer/docker-compose.yml
index c33cc64..4665644 100644
--- a/.devcontainer/docker-compose.yml
+++ b/.devcontainer/docker-compose.yml
@@ -33,7 +33,7 @@ services:
       - KUBECONFIG=/home/dev/.kube/config
       - DATABASE_URL=postgresql://postgres:postgres@db:5432/minikura?sslmode=disable
       - WEB_URL=http://localhost:3001
-      - NEXT_PUBLIC_API_URL=http://localhost:3000
+      - API_URL=http://localhost:3000
       - KUBERNETES_NAMESPACE=minikura
       - ENABLE_CRD_REFLECTION=true
 
diff --git a/.env.example b/.env.example
index 1ffd3a8..698a216 100644
--- a/.env.example
+++ b/.env.example
@@ -6,8 +6,8 @@ DATABASE_URL="postgresql://user:password@localhost:5432/minikura"
 # URL where the web frontend is running (used for CORS)
 WEB_URL="http://localhost:3001"
 
-# API URL that the web frontend should connect to
-NEXT_PUBLIC_API_URL="http://localhost:3000"
+# Internal API URL used by the Next.js server and same-origin browser proxy
+API_URL="http://localhost:3000"
 
 # Kubernetes Configuration
 KUBERNETES_NAMESPACE="minikura"
diff --git a/apps/backend/src/middleware/auth.ts b/apps/backend/src/middleware/auth.ts
index 43fb650..f1ee577 100644
--- a/apps/backend/src/middleware/auth.ts
+++ b/apps/backend/src/middleware/auth.ts
@@ -3,6 +3,8 @@ import { betterAuth } from "better-auth";
 import { prismaAdapter } from "better-auth/adapters/prisma";
 import { admin, openAPI } from "better-auth/plugins";
 
+const webUrl = process.env.WEB_URL || "http://localhost:3001";
+
 export const auth = betterAuth({
   database: prismaAdapter(prisma, {
     provider: "postgresql",
@@ -10,11 +12,11 @@ export const auth = betterAuth({
   }),
   emailAndPassword: { enabled: true },
   plugins: [admin(), openAPI()],
-  trustedOrigins: [process.env.WEB_URL || "http://localhost:3001"],
-  session: {
-    cookieCache: { enabled: true, maxAge: 60 * 5 },
-  },
+  trustedOrigins: [webUrl],
   basePath: "/auth",
+  advanced: {
+    useSecureCookies: webUrl.startsWith("https://"),
+  },
 });
 
 export type Auth = typeof auth;
diff --git a/apps/web/app/page.tsx b/apps/web/app/page.tsx
index 52dd7a5..8e9757e 100644
--- a/apps/web/app/page.tsx
+++ b/apps/web/app/page.tsx
@@ -4,7 +4,7 @@ import { redirect } from "next/navigation";
 
 export const dynamic = "force-dynamic";
 
-const apiUrl = process.env.NEXT_PUBLIC_API_URL || "http://localhost:3000";
+const apiUrl = process.env.API_URL || "http://localhost:3000";
 const api = treaty<App>(apiUrl);
 
 export default async function HomePage() {
diff --git a/apps/web/lib/api-client.ts b/apps/web/lib/api-client.ts
index d5a1e90..98c3cd2 100644
--- a/apps/web/lib/api-client.ts
+++ b/apps/web/lib/api-client.ts
@@ -1,7 +1,10 @@
 import { treaty } from "@elysiajs/eden";
 import type { App } from "@minikura/backend";
 
-const baseUrl = process.env.NEXT_PUBLIC_API_URL || "http://localhost:3000";
+const baseUrl =
+  typeof window === "undefined"
+    ? process.env.API_URL || "http://localhost:3000"
+    : window.location.origin;
 
 export const api = treaty<App>(baseUrl, {
   fetch: {
diff --git a/apps/web/lib/auth-client.ts b/apps/web/lib/auth-client.ts
index 0299423..836e189 100644
--- a/apps/web/lib/auth-client.ts
+++ b/apps/web/lib/auth-client.ts
@@ -2,9 +2,11 @@ import { adminClient } from "better-auth/client/plugins";
 import { createAuthClient } from "better-auth/react";
 
 export const authClient = createAuthClient({
-  baseURL: process.env.NEXT_PUBLIC_API_URL || "http://localhost:3000",
   basePath: "/auth",
   plugins: [adminClient()],
+  fetchOptions: {
+    credentials: "include",
+  },
 });
 
 export const { useSession, signIn, signOut, signUp } = authClient;
diff --git a/apps/web/next.config.mjs b/apps/web/next.config.mjs
index da52b2a..3713525 100644
--- a/apps/web/next.config.mjs
+++ b/apps/web/next.config.mjs
@@ -4,7 +4,21 @@
  * @type {import('next').NextConfig}
  */
 const nextConfig = {
-  /* config options here */
-}
+  async rewrites() {
+    const apiUrl = (process.env.API_URL || process.env.NEXT_PUBLIC_API_URL || "http://localhost:3000")
+      .replace(/\/$/, "");
+
+    return [
+      {
+        source: "/auth/:path*",
+        destination: `${apiUrl}/auth/:path*`,
+      },
+      {
+        source: "/api/:path*",
+        destination: `${apiUrl}/api/:path*`,
+      },
+    ];
+  },
+};
  
-export default nextConfig
\ No newline at end of file
+export default nextConfig;