One concrete gotcha I hit with App Router + NextAuth: useSession() from next-auth/react requires 'use client', which means you can't use it in a Server Component. You have to use auth() from next-auth instead for server-side session access. This tripped up my whole team initially.