NextAuth.js is an open-source authentication library built on standard Web APIs that provides flexible authentication solutions for modern JavaScript applications across any framework, platform, and runtime. Written in TypeScript, the project serves as a comprehensive authentication toolkit designed to work with Next.js, Nuxt, Remix, SvelteKit, Solid.js, and other JavaScript frameworks. The repository is now part of Better Auth, though the maintainers recommend new projects start with Better Auth unless they require specific features like stateless session management without a database.
The library supports a wide range of authentication mechanisms including OAuth 2.0 and OpenID Connect providers, with built-in support for many popular sign-in services. It offers email and passwordless authentication options, passkeys and WebAuthn support, and can function with or without a database backend. This flexibility allows developers to implement stateless authentication with various backend systems including Active Directory and LDAP, or to use traditional database adapters supporting MySQL, MariaDB, Postgres, Microsoft SQL Server, MongoDB, SQLite, and GraphQL.
Security is a core design principle of NextAuth.js. The library implements CSRF token protection on POST routes for sign-in and sign-out operations, uses restrictive cookie policies by default, and encrypts JSON Web Tokens with A256CBC-HS512 encryption. It features tab and window synchronization along with session polling to support short-lived sessions, and the developers have worked to align the implementation with Open Web Application Security Project guidance.
The project maintains active community engagement with significant issue and pull request activity. The repository shares contributors with major projects including Microsoft's VSCode and TypeScript repositories as well as the Rust language project, suggesting it attracts experienced developers from across the ecosystem.
The codebase emphasizes type safety throughout, with TypeScript as the primary language. The library is designed to be secure by default while promoting passwordless sign-in mechanisms and allowing advanced configuration for custom authentication routines, token encoding and decoding, cookie security policies, and session validation logic. The project maintains an ISC license and welcomes community contributions through its established contributing guidelines.
