Auth.js (NextAuth v5)

The most popular authentication library for Next.js and the JS ecosystem

★★★★★

Overview

Auth.js (formerly NextAuth.js) is the most widely used authentication library for JavaScript frameworks. v5 unifies the API across Next.js, SvelteKit, Express, Qwik, and more under the `@auth/*` family of packages.

It takes a provider-first approach — you wire up OAuth providers and the library handles the session and token management. The database adapter is optional; without one, it uses stateless JWTs. With one (Prisma, Drizzle, MongoDB…), it persists sessions and linked accounts.

The schema is intentionally minimal compared to Better Auth — great for getting OAuth working in minutes, but requires more custom work for features like organizations or API keys.

Architecture fit

self-hostedMonolith

Best suited to run inside your main application process alongside your app logic and database.

Key features

◈50+ built-in OAuth providers (GitHub, Google, Twitter, Discord…)

◈Credentials provider for custom email/password

◈Stateless JWT or database sessions (your choice)

◈Prisma, Drizzle, MongoDB, Supabase adapters

◈Magic links (email provider)

◈Middleware-based route protection

◈Works in Next.js, SvelteKit, Express, Nuxt, Qwik

Trade-offs

Largest community + most examples in the ecosystem

−

Minimal schema — custom fields require adapter overrides

Zero database required for JWT-only mode

−

v4 → v5 migration was breaking; frequent API churn

Simplest path to OAuth in under 10 minutes

−

No built-in support for orgs, API keys, 2FA without custom code

Official adapters for every major database/ORM

−

Credentials provider still considered anti-pattern by maintainers

✓ When to use

→Need OAuth working fast in a Next.js or SvelteKit app
→App primarily uses social login (GitHub, Google, etc.)
→JWT-only sessions, no database persistence needed
→Team already familiar with NextAuth v4

✗ When NOT to use

→Need organizations, roles, or API keys out of the box
→Custom auth flows requiring full schema control
→Express/Node apps — Passport still has better ecosystem

Implementation

TypeScript

// auth.ts (App Router, Next.js 14+)
import NextAuth from "next-auth";
import GitHub from "next-auth/providers/github";
import Google from "next-auth/providers/google";
import { PrismaAdapter } from "@auth/prisma-adapter";

export const { handlers, signIn, signOut, auth } = NextAuth({
  adapter: PrismaAdapter(prisma),
  providers: [
    GitHub({ clientId: process.env.GITHUB_ID!, clientSecret: process.env.GITHUB_SECRET! }),
    Google({ clientId: process.env.GOOGLE_ID!, clientSecret: process.env.GOOGLE_SECRET! }),
  ],
  callbacks: {
    session({ session, user }) {
      session.user.id = user.id;
      return session;
    },
  },
});

// app/api/auth/[...nextauth]/route.ts
export const { GET, POST } = handlers;

// middleware.ts — protect all routes except /login
export { auth as middleware } from "@/auth";
export const config = { matcher: ["/((?!login|api/auth).*)"] };

// Server Component — read session
const session = await auth();
if (!session) redirect("/login");

In production

Vercel

Auth.js is maintained by the Vercel team and used across their ecosystem

Thousands of Next.js projects

Most popular auth solution in the Next.js ecosystem since 2021

Other frameworks

Better Auth

library

TypeScript-first, self-hosted authentication with full schema ownership

Clerk

saas

Managed authentication with prebuilt UI components — zero infrastructure

Lucia

primitives

Minimal session management primitives — you control the auth logic

Passport.js

library

The original Node.js authentication middleware — 500+ strategies

← Back to Authentication