What is this?
Auth.js (the next-auth project) is a set of open-source packages for adding authentication to web apps, built on standard Web APIs and designed to work with any framework in any JS runtime.
Auth.js (the next-auth project) is a set of open-source packages for adding authentication to web apps, built on standard Web APIs and designed to work with any framework in any JS runtime.Is this a library I add to my app, or a hosted service I sign up for?You install it into your own application — the auth logic runs inside your own runtime (Docker, Node.js, Serverless), with no external hosted service in the middle.
You install it into your own application — the auth logic runs inside your own runtime (Docker, Node.js, Serverless), with no external hosted service in the middle.How do I add it to my project?Install the package with npm install next-auth, then follow the framework-specific quick start in the docs at authjs.dev — guides cover Next.js, Nuxt, SvelteKit, Solid and Remix setups.
Install the package with npm install next-auth, then follow the framework-specific quick start in the docs at authjs.dev — guides cover Next.js, Nuxt, SvelteKit, Solid and Remix setups.Do I need to set up a database for it to work?No — it works with or without a database: built-in support for MySQL, MariaDB, Postgres, Microsoft SQL Server, MongoDB, SQLite, GraphQL and more, or fully stateless authentication against any backend such as Active Directory or LDAP.
No — it works with or without a database: built-in support for MySQL, MariaDB, Postgres, Microsoft SQL Server, MongoDB, SQLite, GraphQL and more, or fully stateless authentication against any backend such as Active Directory or LDAP.Should I start a new project with this, given the README talks about Better Auth?Auth.js is now part of Better Auth, and the README recommends new projects start with Better Auth unless there are specific feature gaps — most notably stateless session management without a database, which remains this project's distinguishing strength.
Auth.js is now part of Better Auth, and the README recommends new projects start with Better Auth unless there are specific feature gaps — most notably stateless session management without a database, which remains this project's distinguishing strength.What happens to my users' data — does any of it leave my app?Nothing is sent to a third party: it is an open-source solution built so you keep control of your data, with all authentication handled entirely inside your own application.
Nothing is sent to a third party: it is an open-source solution built so you keep control of your data, with all authentication handled entirely inside your own application.Which sign-in methods does it support out of the box?OAuth 2.0+ and OIDC with built-in support for many popular sign-in services, plus email/passwordless authentication and Passkeys/WebAuthn.
OAuth 2.0+ and OIDC with built-in support for many popular sign-in services, plus email/passwordless authentication and Passkeys/WebAuthn.What does it enforce for security without extra configuration?It is secure by default: CSRF tokens on POST routes like sign in and sign out, restrictive cookie policies, JWTs encrypted by default as JWE with A256CBC-HS512, plus session polling and tab syncing for short-lived sessions, following OWASP guidance.
It is secure by default: CSRF tokens on POST routes like sign in and sign out, restrictive cookie policies, JWTs encrypted by default as JWE with A256CBC-HS512, plus session polling and tab syncing for short-lived sessions, following OWASP guidance.Can I decide who is allowed to sign in and how sessions behave?Yes — advanced configuration lets you define routines for controlling which accounts can sign in, custom JWT encoding and decoding, custom cookie security policies, and session properties such as how often sessions must be re-validated.
Yes — advanced configuration lets you define routines for controlling which accounts can sign in, custom JWT encoding and decoding, custom cookie security policies, and session properties such as how often sessions must be re-validated.Do I get TypeScript types when I use it?Yes — the Auth.js libraries are written with type safety in mind; the docs cover the typed setup details.
Yes — the Auth.js libraries are written with type safety in mind; the docs cover the typed setup details.What are similar projects?remix, hydra, zitadel, django-allauth, casdoor, hackathon-starter, logto, SIAPIN
remix, hydra, zitadel, django-allauth, casdoor, hackathon-starter, logto, SIAPIN