We often see developers spending weeks implementing social login, only to run into hydration bugs or session leaks. NextAuth.js (now Auth.js) solves this out of the box in 1–4 days. In our practice — 30+ projects with various providers, from Google to custom. We share a ready-made solution that protects your application and saves budget.
Modern applications require reliable authentication: OAuth, email magic link, login/password. We integrate Auth.js v5 with App Router and Edge Runtime, ensuring fast rendering and security at all stages. Unlike custom solutions, Auth.js provides ready-made providers, automatic CSRF protection, and session management via JWT or database sessions. The choice of strategy depends on load and requirements — we help determine the optimal option. Outcome: time savings of 2–3 times and no security headaches.
For example, on one e‑commerce project we integrated Auth.js with Google OAuth and database sessions. The result: login time dropped from 2.5s to 0.3s due to edge rendering, and we eliminated CSRF vulnerabilities entirely. The client’s support team deployed the update within a day.
What problems does NextAuth.js solve?
NextAuth.js covers three main tasks: session security, multi-provider support, and hybrid SSR/CSR. Sessions can be JWT or database sessions with Prisma. Multi-provider: Google, GitHub, email magic link, login/password — all in one config. Hybrid SSR/CSR: session available both on server and client without extra requests. We configure each of these aspects for a specific project, considering load and security requirements.
How we configure Auth.js v5
We use Auth.js v5 with App Router and Edge Runtime. Configure in auth.ts:
// auth.ts import NextAuth from 'next-auth'; import Google from 'next-auth/providers/google'; import GitHub from 'next-auth/providers/github'; import Credentials from 'next-auth/providers/credentials'; import { PrismaAdapter } from '@auth/prisma-adapter'; import { prisma } from '@/lib/prisma'; export const { handlers, signIn, signOut, auth } = NextAuth({ adapter: PrismaAdapter(prisma), providers: [ Google({ clientId: process.env.AUTH_GOOGLE_ID!, clientSecret: process.env.AUTH_GOOGLE_SECRET! }), GitHub({ clientId: process.env.AUTH_GITHUB_ID!, clientSecret: process.env.AUTH_GITHUB_SECRET! }), Credentials({ credentials: { email: {}, password: {} }, async authorize(credentials) { // find user and verify password }, }), ], session: { strategy: 'database' }, callbacks: { async session({ session, user }) { session.user.id = user.id; return session; }, }, }); Important: for database sessions we provide PrismaAdapter, for JWT — not. Edge Runtime is automatically supported when using App Router.
Provider configuration
Providers are configured in the providers array. For OAuth, you need to specify clientId and clientSecret from the developer console. Credentials provider requires custom verification logic, but Auth.js handles session management and CSRF protection.
Route protection with middleware
// middleware.ts import { auth } from '@/auth'; export default auth((req) => { if (!req.auth) { const loginUrl = new URL('/login', req.url); loginUrl.searchParams.set('callbackUrl', req.url); return Response.redirect(loginUrl); } }); export const config = { matcher: ['/dashboard/:path*', '/settings/:path*'] }; Middleware applies to all routes in the matcher. This is a simple way to protect entire sections without code duplication.
JWT or database sessions: which to choose?
| Criterion | JWT | Database sessions |
|---|---|---|
| Speed | Fast (no DB request) | Slower (request per query) |
| Security | Less secure (reversible token) | More secure (server-side session) |
| Scalability | Easy (stateless) | Harder (stateful, shared DB needed) |
| Session management | Hard to revoke individually | Easy via DB |
Choice depends on your priorities. If speed and simplicity matter — JWT. If security and control — database sessions. In 70% of our projects we use database sessions with Prisma, as it gives more flexibility.
Process and timeline
| Stage | Result |
|---|---|
| Analysis | Select providers, session strategy |
| Integration | Configure OAuth, Credentials, email |
| Protection | Middleware for routes, API |
| Test | Check hydration, Edge |
| Documentation | README, data schema |
Basic integration (OAuth + JWT) takes 1–2 days. With database sessions and magic link — up to 4 days. Cost is calculated individually per project.
Typical mistakes during implementation
The most common mistake is wrong environment variables. AUTH_SECRET is mandatory, otherwise sessions will not be encrypted. Second issue — forgotten PrismaAdapter for database sessions, causing sessions not to persist. Third — missing session type typing, leading to TypeScript errors at compile time. In every project we check these points during code review.
Why trust authentication to professionals?
We have been doing web development for 5+ years and implemented authentication for 30+ Next.js projects. We guarantee stable operation and support after implementation. Contact us for a consultation on your project — we will select the optimal configuration and implement authentication in 1–4 days. Order Auth.js integration and get a ready-made solution with documentation and support.
Additional features
- Email provider: magic link without password — convenient and secure.
- Server Actions: permission checks directly on the server.
- Custom login pages: your design under your brand.
With us you get not just code, but a proven architecture that withstands load and scales easily.