next-auth

Auth.js (previously called NextAuth.js) is an open-source authentication library for JavaScript web applications. Authentication is the process of verifying who a user is — think "sign in with Google" buttons, email magic links, or username/password forms. Building this securely from scratch is complex and error-prone, which is what Auth.js solves.

The library supports a wide range of sign-in methods: OAuth providers like Google, GitHub, and others, email/passwordless login, and passkeys (a newer, password-free standard). You can use it with or without a database — it supports stateless sessions using JWT (JSON Web Tokens, a way to store login state without a database) as well as adapters for databases like MySQL, Postgres, MongoDB, SQLite, and more.

Security defaults are baked in: CSRF (cross-site request forgery) protection on login and logout routes, encrypted tokens, restrictive cookie policies, and session sync across browser tabs. Advanced users can customize what accounts are allowed to sign in, how tokens are encoded, and how often sessions need to be re-validated.

The library is runtime-agnostic, meaning it runs in Node.js, serverless environments, Docker, and more. It works with frameworks like Next.js and Nuxt. The README notes that Auth.js has joined the Better Auth project, and new projects are recommended to start with Better Auth. It's written in TypeScript and licensed under ISC (a permissive open-source license).