I am trying to make the website password-protected.

Locally, it works fine with these environment variables:
NEXTAUTH_URL=http://localhost:3000
NEXTAUTH_SECRET=tcsecret
NEXTAUTH_PASSWORD=tcgpt
---
However, in production it's not working, with these variables:
NEXTAUTH_URL=https://my-website.com
NEXTAUTH_SECRET=tcsecret
NEXTAUTH_PASSWORD=tcgpt
---
middleware.ts
import { withAuth } from 'next-auth/middleware'

export default withAuth({
secret: process.env.NEXTAUTH_SECRET,
})

export const config = {
matcher: [],
}

---
auth.ts:
import { type NextAuthOptions } from 'next-auth'
import CredentialsProvider from 'next-auth/providers/credentials'

export const authOptions: NextAuthOptions = {
providers: [
CredentialsProvider({
name: 'password',
credentials: {
password: {
label: 'Password',
type: 'password',
},
},
async authorize(credentials, _request) {
if (credentials?.password == process.env.NEXTAUTH_PASSWORD) {
return { id: '0' }
} else {
return null
}
},
}),
],
session: {
strategy: 'jwt',
},
pages: {
signIn: '/sign-in',
},
}

---
api/auth/[...nextauth]/route.ts:
import { authOptions } from '@/auth'
import NextAuth from 'next-auth'

const handler = NextAuth(authOptions)

export { handler as GET, handler as POST }