npmIntermediate

next-auth

Complete authentication for Next.js — OAuth providers (Google, GitHub, etc.), email magic links, JWT sessions, and database adapters in one package.

authenticationoauthnextjsjwtsecurity

The Problem

Auth is complex to get right: OAuth flows, CSRF protection, session management, refresh tokens, secure cookies. Rolling your own is weeks of work and a security minefield.

Mental Model

NextAuth exposes a catch-all API route (/api/auth/[...nextauth]) that handles all OAuth callbacks and session endpoints. Configure providers (Google, GitHub, credentials) and an adapter (database). Use useSession() in client components or getServerSession() in server components to access the authenticated user.

60-second start

Add Google + GitHub login to Next.js

// src/app/api/auth/[...nextauth]/route.ts
import NextAuth from 'next-auth';
import Google from 'next-auth/providers/google';
import GitHub from 'next-auth/providers/github';

const handler = NextAuth({
  providers: [
    Google({ clientId: process.env.GOOGLE_ID!, clientSecret: process.env.GOOGLE_SECRET! }),
    GitHub({ clientId: process.env.GITHUB_ID!, clientSecret: process.env.GITHUB_SECRET! }),
  ],
  pages: { signIn: '/login' },
});

export { handler as GET, handler as POST };
// Any server component
import { getServerSession } from 'next-auth';
import { redirect } from 'next/navigation';

export default async function DashboardPage() {
  const session = await getServerSession();
  if (!session) redirect('/login');

  return <div>Welcome, {session.user?.name}</div>;
}

Use it when

Any Next.js app needing auth — social login, email magic links, or username/password. It's the standard choice for Next.js auth.

Skip it when

Non-Next.js projects, when you need very complex RBAC that next-auth doesn't support natively, or when your team owns an existing auth service.

Alternatives

clerkManaged auth service — zero backend code, beautiful UI components

luciaLightweight, framework-agnostic, you own the database

supabase authIf already using Supabase — built-in auth with row-level security

Ready to explore the full API?

See every class, function, and relationship in an interactive graph.