What Auth.js Does
- 80+ OAuth providers — GitHub, Google, Apple, Auth0, Azure AD, Okta, Discord
- Credentials — email/password via custom callback
- Magic links — passwordless email login
- Sessions — JWT (stateless) or database (persistent)
- Database adapters — Prisma, Drizzle, Mongoose, Supabase, Firebase, TypeORM
- Callbacks — customize every step (signIn, jwt, session, redirect)
- CSRF protection — built-in
- Edge runtime — Cloudflare Workers, Vercel Edge
Architecture
Auth.js exposes handlers + helpers. Next.js route handler handles OAuth redirects and callback URLs. Session is either JWT cookie (stateless) or DB lookup via adapter. auth() helper works in RSC, middleware, Route Handlers.
Self-Hosting
Library — runs inside your app. No external service. You bring your own provider credentials and database.
AUTH_SECRET=...
GITHUB_ID=...
GITHUB_SECRET=...Key Features
- 80+ OAuth providers built in
- JWT or DB sessions
- Database adapters (Prisma, Drizzle, Supabase, etc.)
- Multi-framework (Next, Svelte, Remix, Express, Solid, Qwik)
- Edge runtime compatible
- Magic link email sign-in
- TypeScript-first
- Zero vendor lock-in
Comparison
| Library | Self-Host | Providers | Sessions | Frameworks |
|---|---|---|---|---|
| Auth.js | Yes | 80+ | JWT/DB | Multi |
| Clerk | No (SaaS) | 20+ | Managed | Multi |
| Lucia | Yes | DIY | DB | Framework-agnostic |
| Better-Auth | Yes | 20+ | DB | Multi |
| Supabase Auth | Yes (via Supabase) | OAuth + email | Managed | Multi |
常见问题 FAQ
Q: v4 vs v5 区别?
A: v5 (Auth.js) 支持 App Router、edge runtime、简化配置,不再是 pages/api/auth/[...nextauth] 而是 auth.ts。
Q: JWT vs DB session? A: JWT 无状态(扩展简单),但无法立即踢用户下线。DB session 有状态(可撤销)但每请求多一次查询。
Q: 和 Lucia 比? A: Auth.js 开箱即用(80+ providers);Lucia 更底层、灵活度高,需要自己写 provider 适配。
来源与致谢 Sources
- Docs: https://authjs.dev
- GitHub: https://github.com/nextauthjs/next-auth
- License: ISC