use runtime config

server/api/auth/[...].ts

@@ -1,15 +1,18 @@
 import { NuxtAuthHandler } from '#auth'
 import ZitadelProvider from '@auth/core/providers/zitadel'
 
+const config = useRuntimeConfig()
+
 export default NuxtAuthHandler({
-  secret: process.env.AUTH_SECRET,
+  secret: config.authSecret,
   providers: [
     ZitadelProvider({
-      clientId: process.env.ZITADEL_CLIENT_ID,
-      issuer: process.env.ZITADEL_DOMAIN,
+      clientId: config.zitadelClientId,
+      issuer: config.zitadelDomain,
+      pkce: true,
       authorization: {
         params: {
-            scope: `openid email profile offline_access urn:zitadel:iam:org:project:${process.env.ZITADEL_PROJECT_ID}:aud`
+            scope: `openid email profile offline_access urn:zitadel:iam:org:project:${config.projectId}:aud`
         }
       }
     })