Auth.js (NextAuth) — Authentication for the Web

What Auth.js Does

• 80+ OAuth providers — GitHub, Google, Apple, Auth0, Azure AD, Okta, Discord
• Credentials — email/password via custom callback
• Magic links — passwordless email login
• Sessions — JWT (stateless) or database (persistent)
• Database adapters — Prisma, Drizzle, Mongoose, Supabase, Firebase, TypeORM
• Callbacks — customize every step (signIn, jwt, session, redirect)
• CSRF protection — built-in
• Edge runtime — Cloudflare Workers, Vercel Edge

Architecture

Auth.js exposes handlers + helpers. Next.js route handler handles OAuth redirects and callback URLs. Session is either JWT cookie (stateless) or DB lookup via adapter. auth() helper works in RSC, middleware, Route Handlers.

Self-Hosting

Library — runs inside your app. No external service. You bring your own provider credentials and database.

AUTH_SECRET=...
GITHUB_ID=...
GITHUB_SECRET=...

Key Features

• 80+ OAuth providers built in
• JWT or DB sessions
• Database adapters (Prisma, Drizzle, Supabase, etc.)
• Multi-framework (Next, Svelte, Remix, Express, Solid, Qwik)
• Edge runtime compatible
• Magic link email sign-in
• TypeScript-first
• Zero vendor lock-in

Comparison

FAQ

Q: What's the difference between v4 and v5? A: v5 (Auth.js) supports App Router and edge runtime with simplified configuration. It's no longer pages/api/auth/[...nextauth] — it's auth.ts.

Q: JWT vs DB session？ A: JWT is stateless (easy to scale) but you can't kick a user off immediately. Database sessions are stateful (revocable) but add one query per request.

Q: How does it compare to Lucia? A: Auth.js is plug-and-play (80+ providers); Lucia is lower-level and more flexible, but you need to write provider adapters yourself.

Sources & Credits

• Docs: https://authjs.dev
• GitHub: https://github.com/nextauthjs/next-auth
• License: ISC