Auth.js (NextAuth)
Open-source library for Next.js, SvelteKit, SolidStart. Free, self-managed user database.
VISIT AUTH.JS (NEXTAUTH)Key takeaway: The zero-cost default for Next.js and SvelteKit projects with straightforward requirements: social logins, email, your own user table, no monthly bill. It stops being the obvious answer once you need organisations, members and per-tenant roles, where the abstractions actively fight you. Better Auth is the modern alternative worth comparing against before you commit.
Quick facts
- CategoryLibrary / OSS
- LanguageTypeScript
- PricingOpen source
- LicenseISC
- Created2016
- GitHub stars26.4k
- HIPAA-eligibleNo
- SSO / SAMLLimited / paid
What it is
Auth.js (formerly NextAuth.js) is the standard open-source auth library for Next.js, SvelteKit, and SolidStart. Provider-based, wire up Google, GitHub, email, credentials, etc. You own the user database; library handles the OAuth dances and session management.
Best for
- Next.js / SvelteKit / SolidStart teams that want zero auth bill
- Apps where owning the user database is the priority
- Projects with simple auth needs (social login + email)
When not to pick it
Skip Auth.js for complex multi-tenant briefs, the abstractions get awkward at organisation-with-members shape. Skip for teams that want pre-built UI; you build the components yourself.
My take
Auth.js is the default zero-cost auth library for the React ecosystem. Trade-off is that you build the UI and the user-management surfaces yourself.
Providers, adapters, and the shape of the library
The design is two pluggable layers. Providers handle the OAuth dance with Google, GitHub and dozens of others, plus email and credentials flows. Adapters persist users and sessions into whatever database you already run, through Prisma, Drizzle or a direct driver. That removes a lot of tedious protocol work for free, and the breadth of providers means the less common OAuth source you need probably already has an entry. The friction is in the seams. The credentials provider is deliberately limited and the documentation is honest that it discourages password auth. Session callbacks are where most non-trivial logic ends up and they are easy to get subtly wrong. The move to the current major version also broke enough patterns that a lot of stale tutorials still circulate and will waste your afternoon. Expect to read the source at some point.
Where it runs out, and what replaces it
Auth.js was designed for a user who signs in and is themselves. Multi-tenant products need a user who belongs to several organisations with different roles in each, plus invitations, ownership transfer and per-organisation settings, and none of that is modelled for you. You can build it, and plenty of teams have, but you are building on callbacks and your own tables rather than using primitives the library provides. That is the specific moment teams look at Better Auth, which ships organisation support natively, or at Clerk, which sells the whole thing including the admin screens. The other permanent trade is UI. Every screen is yours, including the parts nobody enjoys: password reset, email verification and account linking. Free means free of invoices, not free of work.
Frequently asked questions
Is Auth.js the same as NextAuth?
Yes. Auth.js is the renamed and broadened continuation of NextAuth.js, now supporting SvelteKit and SolidStart alongside Next.js. The rename came with a major version that changed configuration patterns significantly, so older NextAuth tutorials will not work directly against it and are a common source of confusion for people starting today.
Auth.js or Better Auth?
Auth.js for a simple Next.js app with social logins, where its maturity and provider breadth are the draw. Better Auth for greenfield TypeScript projects, especially multi-tenant ones, where organisation primitives and a cleaner API matter more than years of accumulated fixes. The abstraction friction people hit in Auth.js is exactly what Better Auth was built to answer.
Is Auth.js free?
Yes, it is open source under the ISC licence with no cost and no user limits. You provide the database and build the interface, so the real expense is engineering time on sign-in screens, password reset, email verification, and whatever organisation or role model your product turns out to need.
Links
Compare Auth.js (NextAuth) side-by-side
Similar tools you should also consider
If Auth.js (NextAuth) is your pick, the next conversation is short
The 30-min call is where your auth choice becomes a real architecture, a migration plan if you are switching, and a price range you can take to your stakeholders. Describe your stack, your scale, your compliance constraints. I tell you whether Auth.js (NextAuth) is genuinely your fit.