NextAuth.js / Auth.js

What problem does it solve?

Authentication setups in Next.js apps easily become inconsistent and unsafe when route handlers, session configuration, and role checks are scattered across the codebase. Architecting NextAuth correctly prevents broken sign-in/CSRF flows, avoids mismatched session strategies, and ensures protected routes reliably enforce authorization across both server and client.

Core Features & Use Cases

• Centralized auth configuration: Keep providers, callbacks, adapter wiring, JWT/database session strategy, and custom session field mapping in a single exported authOptions file.
• Correct NextAuth route handling: Use the catch-all NextAuth route handler directory and export both GET and POST handlers so OAuth callbacks and CSRF protection work end-to-end.
• Consistent session access and protection: Use getServerSession for Server Components and routes, useSession for Client Components, and protect routes via NextAuth middleware with an appropriate matcher and role-based authorized callback.

Quick Start

Ask your coding agent to implement a NextAuth.js/Auth.js setup using app/api/auth/[...nextauth]/route.ts with GET and POST exports, a single src/lib/auth.ts authOptions export, and middleware protection for protected routes while using getServerSession on the server and useSession in client components.