Skip to main content

Interface: AuthOptions

index.AuthOptions

Configure your NextAuth instance

Documentation

Properties​

providers​

• providers: Provider[]

An array of authentication providers for signing in (e.g. Google, Facebook, Twitter, GitHub, Email, etc) in any order. This can be one of the built-in providers or an object with a custom provider.

  • Default value: []
  • Required: Yes

Documentation | Providers documentation

adapter​

• Optional adapter: Adapter<boolean>

You can use the adapter option to pass in your database adapter.

  • Required: No

Documentation | Adapters Overview

callbacks​

• Optional callbacks: Partial<CallbacksOptions<Profile, Account>>

Callbacks are asynchronous functions you can use to control what happens when an action is performed. Callbacks are extremely powerful, especially in scenarios involving JSON Web Tokens as they allow you to implement access controls without a database and to integrate with external databases or APIs.

  • Default value: See the Callbacks documentation
  • Required: No

Documentation | Callbacks documentation

cookies​

• Optional cookies: Partial<CookiesOptions>

You can override the default cookie names and options for any of the cookies used by NextAuth.js. You can specify one or more cookies with custom properties, but if you specify custom options for a cookie you must provide all the options for that cookie. If you use this feature, you will likely want to create conditional behavior to support setting different cookies policies in development and production builds, as you will be opting out of the built-in dynamic policy.

  • Default value: {}
  • Required: No
  • ⚠ This is an advanced option. Advanced options are passed the same way as basic options, but may have complex implications or side effects. You should try to avoid using advanced options unless you are very comfortable using them.

Documentation | Usage example

debug​

• Optional debug: boolean

Set debug to true to enable debug messages for authentication and database operations.

  • Default value: false
  • Required: No
  • ⚠ If you added a custom logger, this setting is ignored.

Documentation | Logger documentation

events​

• Optional events: Partial<EventCallbacks>

Events are asynchronous functions that do not return a response, they are useful for audit logging. You can specify a handler for any of these events below - e.g. for debugging or to create an audit log. The content of the message object varies depending on the flow (e.g. OAuth or Email authentication flow, JWT or database sessions, etc), but typically contains a user object and/or contents of the JSON Web Token and other information relevant to the event.

  • Default value: {}
  • Required: No

Documentation | Events documentation

jwt​

• Optional jwt: Partial<JWTOptions>

JSON Web Tokens are enabled by default if you have not specified an adapter. JSON Web Tokens are encrypted (JWE) by default. We recommend you keep this behaviour.

  • Default value: See the documentation page
  • Required: No

Documentation

logger​

• Optional logger: Partial<LoggerInstance>

Override any of the logger levels (undefined levels will use the built-in logger), and intercept logs in NextAuth. You can use this option to send NextAuth logs to a third-party logging service.

  • Default value: console
  • Required: No

Example

// /pages/api/auth/[...nextauth].js
import log from "logging-service"
export default NextAuth({
  logger: {
    error(code, ...message) {
      log.error(code, message)
    },
    warn(code, ...message) {
      log.warn(code, message)
    },
    debug(code, ...message) {
      log.debug(code, message)
    }
  }
})
  • ⚠ When set, the debug option is ignored

Documentation | Debug documentation

pages​

• Optional pages: Partial<PagesOptions>

Specify URLs to be used if you want to create custom sign in, sign out and error pages. Pages specified will override the corresponding built-in page.

  • Default value: {}
  • Required: No

Example

  pages: {
    signIn: '/auth/signin',
    signOut: '/auth/signout',
    error: '/auth/error',
    verifyRequest: '/auth/verify-request',
    newUser: '/auth/new-user'
  }

Documentation | Pages documentation

secret​

• Optional secret: string

A random string used to hash tokens, sign cookies and generate cryptographic keys. If not specified, it falls back to AUTH_SECRET or NEXTAUTH_SECRET from environment variables. To generate a random string, you can use the following command:

On Unix systems: openssl rand -hex 32 Or go to https://generate-secret.vercel.app/32

Default

process.env.AUTH_SECRET ?? process.env.NEXTAUTH_SECRET

Documentation

session​

• Optional session: Partial<SessionOptions>

Configure your session like if you want to use JWT or a database, how long until an idle session expires, or to throttle write operations in case you are using a database.

  • Default value: See the documentation page
  • Required: No

Documentation

theme​

• Optional theme: Theme

Changes the theme of pages. Set to "light" if you want to force pages to always be light. Set to "dark" if you want to force pages to always be dark. Set to "auto", (or leave this option out)if you want the pages to follow the preferred system theme.

  • Default value: "auto"
  • Required: No

Documentation | Pages documentation

trustHost​

• Optional trustHost: boolean

If set to true, NextAuth.js will use either the x-forwarded-host or host headers, instead of NEXTAUTH_URL Make sure that reading x-forwarded-host on your hosting platform can be trusted.

  • ⚠ This is an advanced option. Advanced options are passed the same way as basic options, but may have complex implications or side effects. You should try to avoid using advanced options unless you are very comfortable using them.

Default

Boolean(process.env.NEXTAUTH_URL ?? process.env.AUTH_TRUST_HOST ?? process.env.VERCEL)

useSecureCookies​

• Optional useSecureCookies: boolean

When set to true then all cookies set by NextAuth.js will only be accessible from HTTPS URLs. This option defaults to false on URLs that start with http:// (e.g. http://localhost:3000) for developer convenience. You can manually set this option to false to disable this security feature and allow cookies to be accessible from non-secured URLs (this is not recommended).

  • Default value: true for HTTPS and false for HTTP sites
  • Required: No

Documentation

  • ⚠ This is an advanced option. Advanced options are passed the same way as basic options, but may have complex implications or side effects. You should try to avoid using advanced options unless you are very comfortable using them.