NextAuth.js

NextAuth.js is the official Auth.js integration for Next.js, providing a complete authentication layer for App Router and Pages Router applications. A single NextAuth() call wires up route handlers, session management, and helpers for signing users in and out, while built-in support for OAuth 2.0, OIDC, email/passwordless, and WebAuthn passkeys covers the sign-in methods most apps need.

Built on standard Web APIs through the @auth/core runtime, it runs anywhere Next.js does — Node.js, serverless, and edge — and works with or without a database via pluggable adapters. It is secure by default, using encrypted JWTs, CSRF protection, and restrictive cookie policies out of the box.

What You Get

• A single NextAuth() factory that returns route handlers and auth/signIn/signOut helpers
• Built-in providers for dozens of OAuth/OIDC services plus email and credentials sign-in
• React client with SessionProvider and useSession for accessing session state anywhere
• Database adapters for Postgres, MySQL, MongoDB, Prisma, Drizzle, and many more
• Passkey/WebAuthn support and encrypted, CSRF-protected sessions by default

Common Use Cases

• Adding social login (GitHub, Google, etc.) to a Next.js application
• Implementing passwordless email or passkey authentication
• Protecting App Router pages and API routes with session-aware middleware
• Persisting users and sessions to a database through an adapter

Under The Hood

Architecture — The public surface lives in packages/next-auth/src, where the NextAuth() factory in index.ts accepts a config (or a request-aware function) and returns { handlers, auth, signIn, signOut, unstable_update }. The handlers.GET/POST delegate to Auth(reqWithEnvURL(req), config) from @auth/core, which does the real OAuth/OIDC/session work; initAuth and setEnvDefaults in src/lib layer Next.js-specific request handling and environment inference on top. The React client in react.tsx ships a SessionProvider and useSession hook that fetch session state from the auth API base URL.

Tech Stack — Written almost entirely in TypeScript (~94% of the repo). The package depends on the workspace @auth/core runtime and declares peer dependencies on next, react, nodemailer, and @simplewebauthn packages (the latter optional for passkeys). The repo is a pnpm + Turborepo monorepo housing packages/core, the many database adapters, and per-framework integrations; the package builds with tsc and generates provider entry points via a shared script.

Code Quality — Tests exist and run on Vitest (actions.test.ts, env.test.ts, middleware-fail-closed.test.ts) alongside Playwright end-to-end suites, using a shared config from packages/utils. The codebase is strongly typed with dedicated types.ts modules, and security-sensitive defaults (encrypted JWE tokens, CSRF, fail-closed middleware) are explicitly covered.

API Design — The developer experience is a highlight: a single NextAuth() call yields everything an app needs, providers are imported by path (e.g. next-auth/providers/github), and environment variables like AUTH_GITHUB_ID are inferred automatically to minimize boilerplate. Documentation is extensive both inline (rich JSDoc module comments) and on the authjs.dev site.