next-auth

removed the notice about vercel like 3 hours after the announcement https://github.com/nextauthjs/next-auth/commit/9215909ffd7ae...

> I don’t think it’s great to see a truly free project get absorbed into a commercial venture. Auth.js and NextAuth.js didn't seem to be in a healthy state. Work on NextAuth.js v5 began way back in May 2023.[1][2] NextAuth.js v5 was renamed to Auth.js in August 2023.[3] v5.0.0-beta.0 was released in October 2023.[4] Balázs Orbán, the main contributor to Auth.js and NextAuth.js, quit in January 2025.[5][6] v5 is still in beta after all this time. It never had a stable release. [1] https://github.com/nextauthjs/next-auth/pull/7443 [2] https://github.com/nextauthjs/next-auth/discussions/8487 [3] https://github.com/nextauthjs/next-auth/commit/a996ab57e8ffc... [4] https://www.npmjs.com/package/next-auth/v/5.0.0-beta.0 [5] https://github.com/nextauthjs/next-auth/commits?author=balaz... [6] https://x.com/balazsorban44/status/1943635445235040488

Does it handle: - Federated sign-in/out? In next-auth, it is a giant pain to implement: https://github.com/nextauthjs/next-auth/discussions/3938 - Automated refreshing of JWT tokens on the client-side? I always end up having to implement my own logic around this. The big problem is if you have multiple API calls going out and they all require JWT auth, you need to check the JWT validity and block the calls until it is refreshed. In next-auth on the server-side, this is impossible to do since that side is generally stateless, and so you end up with multiple refresh calls happening for the same token. - The ability to have multiple auth sessions at once, like in a SaaS app where you might belong to multiple accounts / organizations (your intro paragraph sounds like it does) - Handle how multiple auth sessions are managed if the user happens

thanks for the link! i hear you on not having to build for everyone and it's good to take a stance and not be for everyone / every use case. dhh talked about this at railsworld recently [0]. i think i've got it working ok with the second request to update the session (as suggested here [1]). [0]: https://www.youtube.com/watch?v=zPBbHu-BKpQ [1]: https://github.com/nextauthjs/next-auth/discussions/9715

I use authjs (aka next-auth) and recently documented that Google login requests additional access every time the user logs in[1]. I created an issue with a repro, although the maintainers moved it to discussions. It seems that the problem is with Google, but in that case I don't understand why the next-auth example works fine[2]. There are other users affected. If anyone knows how to solve this problem, I would appreciate it if you could say so. https://github.com/nextauthjs/next-auth/discussions/11160 https://next-auth-example.vercel.app/

from time to time config is just not willing to sit there in a list. it needs to be computed. just an example from a few days ago. someone needs to pull data from some remote service (maybe Vault), or generation of keys/entropy/etc. [0][1] of course this just means folks should wrap the whole thing in a program. but that's getting inefficient fast if every layer only accepts "env vars" or a plain JSON file. [0] https://github.com/nextauthjs/next-auth/pull/9638#issuecomme... [1] https://github.com/nextauthjs/next-auth/pull/9638#issuecomme...

I can't recommend enough Zitadel and its OIDC library. Code is very well-writen and informative. Highly encourage everyone jump into source code and explore how IntrospectionResponse struct work with all related code around https://github.com/zitadel/oidc/blob/main/pkg/oidc/introspec... // IntrospectionResponse implements RFC 7662, section 2.2 and // OpenID Connect Core 1.0, section 5.1 (UserInfo). // https://www.rfc-editor.org/rfc/rfc7662.html#section-2.2. // https://openid.net/specs/openid-connect-core-1_0.html#Standa.... type IntrospectionResponse struct { Active Scope ClientID TokenType ... exp iat nbf sub Audience ... aud ... JWTID ... Claims map[string]any } If you want to explore the difference between identity providers, click through https://github.com/nextauthjs/next-auth/tree/main/packages/c... Azure is the most

It is definitely fairly easy to get started with and supports a wide range of authenticators (at least next-auth does, authjs not so many at the moment). The work on next-auth has been stopped in favour of this (also after some issues and rollback [1]). One thing I was pleasantly surprised by was how easy it is too rollout email authentication via magic links and how relatively good it looks/behaves out of the box [2]. All you need is to add SMTP url and add the config. It is also worth noting that it doesn't work for nextjs yet. [1]: https://github.com/nextauthjs/next-auth/pull/6132 [2]: https://aihelperbot.com/signin Edit: Formatting.

I went down the rabbithole of using next-auth (now authjs) for a recent project. Having used Passport.js [1] for Oauth2 the last time I was doing node.js ~3 years ago, I found this library to have many footguns as comments/answers on SO and Github. Seems like many people are trying to shoehorn their codebase [2] (!!) to make it work with the way the library manages sign-in flow, redirects, cookies, logout, etc. [3] These were solved problems in the MEAN stack era with middlewares, but now that Next.js/react is the trend, people are doing everything they can to make it work - from relaxing security configs, to stashing things in the JWT just so some callback can get an additional piece of data [4]. [1] https://github.com/jaredhanson/passport [2] https://github.com/nextauthjs/next-auth/issues/600#issuecomm... [3] https://stackoverflow.com/q

You can implement this in about 10 lines with synced tab session management if you use Vercel's library. https://authjs.dev/ Here is the token generation logic https://github.com/nextauthjs/next-auth/blob/main/packages/n...