Auth

Auth.js

An open source authentication library for web apps (formerly NextAuth.js), with OAuth providers and sessions.

Official siteRepository

What it is

Auth.js began as NextAuth.js for Next.js and later became framework-agnostic. The library lives inside your app, and user data is stored in your database through adapters.

It has ready providers (Google, GitHub and dozens more), email magic-link sign-in, credentials login and built-in session handling: a JWT cookie or database sessions.

It is a good choice if you want control and no per-user fee. Responsibility for configuring security correctly is yours.

Use it when

  • A Next.js or SvelteKit app with social login.
  • You want control over data without a separate identity server.
  • Small and medium projects on a limited budget.

Avoid it when

  • You need enterprise SSO, SAML and organization management out of the box: Auth0, Clerk, Keycloak.
  • Mobile apps and service-to-service authorization.

Key concepts

Provider
An external sign-in configuration (Google, GitHub).
Adapter
A layer that stores users and sessions in your database.
Session strategy
A JWT in a cookie or a session record in the database.
Callbacks
jwt and session hooks for adding custom fields.

Example

A minimal config with the GitHub provider.

Interview questions

  1. 1. JWT or database sessions?

    A JWT session needs no database hit per request but is harder to revoke. A database session revokes instantly but adds a storage lookup.

  2. 2. What are adapters for?

    To store users, accounts and sessions in your database (Prisma, Drizzle and others). Without an adapter only the JWT strategy is available.

  3. 3. Is the credentials provider safe?

    It works, but you own password hashing, attempt limiting and resets. For most cases social providers or email links are better.

Related technologies

Logos belong to their owners and are used for identification only. Icons: Simple Icons (CC0), Devicon (MIT).

Explore the platform