How to Add Authentication to Next.js with Auth.js (NextAuth)

Authentication is table stakes for any SaaS, and Auth.js (formerly NextAuth) is the most popular way to add it to Next.js. Here's how the pieces fit together.

Choose your providers

Auth.js supports OAuth providers (Google, GitHub, and dozens more), email magic links, and credentials (email + password). Most SaaS products offer at least one OAuth provider plus email, so users can sign in the way they prefer.

Persist users with an adapter

An adapter stores users, accounts, and sessions in your database. The Prisma adapter maps cleanly onto a Postgres schema with `User`, `Account`, `Session`, and `VerificationToken` tables. With database sessions, you can revoke access instantly and add fields like roles and a blocked flag.

Protect routes and server actions

• Call `auth()` in a server component or layout to read the current session.
• Redirect to `/login` when there's no session for protected areas.
• Guard mutations by re-checking the session (and role) inside each server action — never trust the client.
• Use middleware for coarse-grained protection of whole route groups.

Add roles for admin areas

A simple `role` enum (USER, ADMIN) on the user, optionally combined with an env allowlist of admin emails, lets you gate an admin dashboard. Check the role on both the layout (for the UI) and every admin action (for security).

KitCraft's SaaS templates ship Auth.js v5 wired to Prisma and Postgres out of the box — OAuth, email login, database sessions, and role-based admin access already in place.