Auth.js

What it is

Auth.js (NextAuth.js) is the de facto open-source auth library for Next.js and other JS frameworks — OAuth, email, and credentials with your own database.

The free, open-source default auth for Next.js.

When it fits — and when it doesn’t

Known weaknesses

Each one links to the public issue, changelog or docs page it came from, where we have one.

1. 01

   Token rotation is broken, causing new tokens from external IDPs to be lost and old tokens to be reused indefinitely.

   A long-standing open issue with 64 reactions reports that when rotating tokens, the new token is not stored, leading to security and functionality issues where the old token persists.

   Source: GitHub issue #7558 ↗
2. 02

   The v5 release is in beta with unclear stability and security implications for production use.

   Users report that documentation lacks information on why v5 is labeled beta, including potential security risks or significant limitations, making it difficult to decide on production adoption.

   Source: GitHub issue #12188 ↗
3. 03

   Session state is not updated on the client side after sign-out, requiring manual page reloads.

   An open issue with 26 reactions indicates that the signOut function does not automatically update the useSession state, leading to inconsistent UI behavior.

   Source: GitHub issue #11125 ↗
4. 04

   JWT modification for refreshing access tokens is not possible after initial login.

   A recent open issue with 27 reactions reports that users cannot update the JWT to refresh access tokens, limiting the tool's utility for OAuth flows requiring token refresh.

   Source: GitHub issue #12454 ↗

What it does well

• Free and open source

  No per-user fees; runs entirely in your app

• First-class Next.js integration

  The default auth choice for the Next.js ecosystem

• Many OAuth providers built in

  Dozens of prebuilt provider configs

Pricing

Free tier

YesFully free and open source

Paid from

$0

Model

Flat rate

Enterprise plan

No

Pricing not independently confirmed — check the vendor’s page.