repository·main·Indexed 12 days ago
https://github.com/nextauthjs/next-authA set of open-source, framework-agnostic and runtime-agnostic packages providing authentication for modern web applications. It supports OAuth, Email, and Passkeys, and provides dedicated integrations for Next.js, Express (@auth/express), SvelteKit (@auth/sveltekit), and Qwik City, as well as various database adapters including Drizzle, Firebase, Cloudflare D1, and Azure Table Storage.
Auth.js is a runtime-agnostic authentication library built on standard Web APIs. It is designed to integrate with various modern JavaScript frameworks to provide a secure, private, and extensible authentication experience.
Note: This documentation specifically covers next-auth@5.0.0-beta and later, as well as other framework-specific packages under the @auth/* namespace. For legacy next-auth@4.x.y documentation, refer to next-auth.js.org.
@auth/core) is the underlying authentication engine designed for the web. It provides a framework-agnostic authentication logic that can be used across various web environments. It is written in TypeScript and focuses on being secure by default and allowing developers to own their data.Auth.js (formerly NextAuth.js) is an open-source, full-stack authentication solution built on standard Web APIs. It is designed to work with any framework, on any platform, and in any JavaScript runtime (e.g., Node.js, Docker, Serverless).
Key capabilities include:
NextAuth.js provides integrations for various web frameworks and databases. Most modern integrations are published under the @auth/* scope and are built upon the @auth/core library.
next-auth): Available in v4 (maintenance mode) and v5 (beta).@auth/qwik): Released.@auth/express): Experimental Release.@auth/solid-start): Experimental Release.@auth/sveltekit): Experimental Release.@auth/*-adapter: The current standard. These are released and fully compatible with next-auth and all @auth/* framework libraries.@next-auth/*-adapter: Legacy adapters. Maintenance has stopped; users should migrate to the @auth/*-adapter versions.@auth/ namespace. These adapters act as the bridge between Auth.js and your database. If your specific database is not supported, you can create a custom adapter by following the official guide and ensuring it implements the required Auth.js models.@auth/sveltekit package. You can use this as a reference implementation for your own SvelteKit projects.Automated End-to-End (E2E) testing of authentication can be difficult because OAuth providers often trigger security verification steps (like geographic location checks or new user-agent alerts) when accessed from datacenters or CI environments.
To achieve consistent and repeatable testing, use one of these two strategies:
Credentials provider in development: Enable a Credentials provider that is conditionally added to your configuration only when process.env.NODE_ENV === 'development'. This avoids the overhead of a separate provider but requires strict environment checks to ensure it is never enabled in production.@auth/express) provides authentication capabilities specifically designed for Express.js applications. It allows you to implement secure authentication flows within the Express framework.NextAuth.js v5 introduces several key improvements:
pages/ is still supported.auth() function: A single method to authenticate in almost any environment (Server Components, Middleware, API Routes, etc.), replacing getServerSession, getSession, withAuth, getToken, and useSession.account() callback: Available on providers for enhanced data handling.@auth/express into an Express.js application. It serves as the official reference implementation for using Auth.js with the Express framework.Auth.js supports four primary authentication methods: