Auth.js

Why it's ranked here

The breadth is substantial: several sign-in methods, configurable session storage, restrictive cookie defaults, CSRF protection, and many database options. The verdict is mixed for new builds, however. The core package is marked experimental, the Next.js package uses a beta install, and the maintainers recommend Better Auth for most new projects.

What's good

Security choices are concrete rather than decorative. POST sign-in and sign-out routes use CSRF tokens, token sessions are encrypted by default, and cookies receive restrictive defaults. Teams can rotate secrets without invalidating existing sessions, customize revalidation, or keep sessions stateless when a database adds no value.

Tradeoffs

Its flexibility creates configuration responsibility. Teams must choose providers, session strategy, cookie policy, storage, and access callbacks carefully. Database support comes through separate adapters and client packages. Some adapters expose backend-specific caveats, while the project explicitly directs most new applications toward Better Auth.

How to use it well

Use it when a JavaScript application needs embedded authentication, especially when stateless encrypted sessions, provider choice, or ownership of stored identity data matters. Start from a framework integration, select a provider, then add an adapter only when persistent sessions are required. It does not supply your OAuth service, database, or application authorization policy.

Observed

License

ISC

Primary language

TypeScript

Interface

JavaScript library packages, framework integrations, and an Auth.js CLI for secret generation

Package surface

Published through npm packages including the core library, Next.js integration, and separate database adapters

Runtime support

Standard Web APIs across JavaScript runtimes, including Node.js, serverless environments, and Docker deployments

Session storage

Encrypted JWT sessions without a database, or database-backed sessions through adapters

Authentication methods

OAuth 2.0+, OIDC, email passwordless authentication, credentials, and passkeys or WebAuthn

Repository structure

Private pnpm and Turbo monorepo with build, unit test, and end-to-end test scripts