nextauthjs/next-auth

Authentication for the Web.

GitHub(opens in a new tab)Homepage(opens in a new tab)TypeScriptISC28,375 stars

Superseded, approved

Summary

nextauthjs/next-auth — Authentication for the Web — is catalogued under Authentication and identity. As of 2026-10-31, nextauthjs/next-auth is reviewed as superseded. The upstream README states Auth.js is now part of Better Auth and recommends Better Auth for new projects, unless stateless session management without a database is required. The reviewed successor is better-auth/better-auth. Its RepoFacts health score is 73/100 (Sound; low confidence, provisional). Its npm package next-auth averaged 968,477 downloads a day over the last 90 days, up 41% on the previous 90 days. Reviewed recommendation: keep it in existing projects only.

Lifecycle on GitHub
activeVerified
Editorial status
SupersededApproved
Recommendation
Existing projects onlyApproved
Last verified
2026-10-3146 snapshots on record

Reviewed by cmartinzip on 2026-09-16; the rationale is in the summary above. Rule-derived status would be active.

Health

73Sound

Low confidence · evidence covers 61% of weight · provisional

Rank 08 / 12 in Stack Atlas · #2 of 2 in Authentication and identity

Is it sustainable and safe enough to evaluate?

Momentum

Volatile

Rising: adoption. Falling: contribution.

Is attention, adoption, or contribution growing?

Stack fit

Not evaluated

Stack Fit reads a saved technology profile. It arrives with the personalized Stack Fit phase; no score is shown until then.

Does it fit your runtime, database, and deployment?

  • Strongest signal. Documentation scores 100 — README: Present.
  • Watch. Community depth scores 0 — Human contributors (90 days): 0 distinct non-bot authors.

Health dimensions

repofacts-health-v1
Health dimensions with weight, score, evidence coverage, and the signals behind each score
DimensionWeightScoreCoverageSignals
Maintenance20%48100%
3 of 3 scored
  • Latest non-bot commit652026-07-22, 101 days ago.
  • Weeks with commits (last 13)00 of 13 weeks had commits. Includes bot commits.
  • Latest stable release80next-auth@4.24.15, published 103 days ago.
Security posture20%10025%
1 of 4 scored
  • Security policy100A security policy is published.
  • Security advisories—Not collected in v0. Absence of data is not absence of vulnerabilities.
  • OpenSSF Scorecard—Not collected in v0.
  • Release provenance—Not collected in v0.
Documentation12%100100%
3 of 3 scored
  • README100Present.
  • Contributing guide100Present.
  • Homepage or docs site100Listed on the repository.
Stability12%100100%
3 of 3 scored
  • Prerelease share (last year)1003% of 62 releases were prereleases.
  • Primary package ≥ 1.0100next-auth@4.24.15.
  • Primary package not deprecated100next-auth is not deprecated.
Community depth12%050%
1 of 2 scored
  • Human contributors (90 days)00 distinct non-bot authors.
  • Top contributor share (90 days)—Too few human commits in the window to measure concentration.
Dependency exposure10%No evidence0%
0 of 2 scored
  • Dependency count—Not collected in v0.
  • Vulnerable dependencies—Not collected in v0.
Operational burden8%No evidence0%
0 of 1 scored
  • Required services—Editorial assessment, not collected in v0.
Governance6%100100%
3 of 3 scored
  • Machine-detectable license100ISC.
  • Code of conduct100Present.
  • Issue or PR templates100Present.

Momentum signals

repofacts-momentum-v0
Momentum by signal family, comparing the current window with the previous window of the same length
SignalWindowCurrentPreviousDirectionBasis
Development91 days0 commits16 commitsNot measured0 commits in the last 13 weeks vs 16 in the 13 before. Includes bot commits. Previous-window baseline 16 is below the 26 floor, so a ratio would be a small-number artefact.
Contribution90 days0 contributors6 contributorsFalling strongly (0×)0 human contributors in the last 90 days vs 6 before.
Adoption90 days968,477 downloads/day688,080 downloads/dayRising (1.41×)next-auth: 968,477 downloads/day over the last 90 days vs 688,080 before. Registry counts include CI and mirrors.
Attention———Not measuredStar history accumulates from RepoFacts snapshots and needs 60 days of them. It is never reconstructed.

Composite score withheld. A composite score is normalized within a category cohort of at least 8 repositories. This category has 2. Hidden Gem: not eligible — Composite momentum needs a category cohort of at least 8; this category has 2. Above the 5,000-star attention ceiling.

Packages

npm
Packages published from this repository and whether their identity matches it
PackageLatestIdentityDownloads/day (90d)
next-auth(opens in a new tab)primary4.24.15MatchedManifest repository is nextauthjs/next-auth.968,477
@auth/core(opens in a new tab)0.41.3MatchedManifest repository is nextauthjs/next-auth.699,616

Alternatives and successors

  • Superseded bybetter-auth/better-authApproved

    The next-auth README (read 2026-09-16) states Auth.js is now part of Better Auth and recommends Better Auth for new projects, except where stateless sessions without a database are required. Evidence(opens in a new tab)

Common questions about nextauthjs/next-auth

Is nextauthjs/next-auth still maintained?
As of 2026-10-31, nextauthjs/next-auth is reviewed as superseded. The upstream README states Auth.js is now part of Better Auth and recommends Better Auth for new projects, unless stateless session management without a database is required. The reviewed successor is better-auth/better-auth.
Is nextauthjs/next-auth deprecated?
Not formally: as of 2026-10-31 GitHub does not mark nextauthjs/next-auth archived and npm does not mark next-auth deprecated, but it is reviewed as superseded. The reviewed successor is better-auth/better-auth. Reviewed recommendation: keep it in existing projects only.
How healthy is nextauthjs/next-auth?
Its RepoFacts health score is 73/100 (Sound; low confidence, provisional). The main watch item: Community depth scores 0 — Human contributors (90 days): 0 distinct non-bot authors.
How widely is nextauthjs/next-auth used?
nextauthjs/next-auth has 28,375 GitHub stars, which measure attention rather than use. Its npm package next-auth averaged 968,477 downloads a day over the last 90 days, up 41% on the previous 90 days. Registry download counts include CI installs and mirrors. Checked 2026-10-31.
What can I use instead of nextauthjs/next-auth?
Reviewed relationships in Stack Atlas point to better-auth/better-auth. Compare their RepoFacts profiles before migrating.

Evidence

snapshot 2026-10-31

Every value collected for this profile, with its provenance. Source links are the API endpoints that answered. Unknown and unavailable values are shown as such and never counted as zero.

Collected evidence with provenance, observation window, source, and caveats
GroupFieldValueProvenanceSource and notes
RepositoryArchivedNoVerifiedhttps://api.github.com/repos/nextauthjs/next-auth
RepositoryDisabledNoVerifiedhttps://api.github.com/repos/nextauthjs/next-auth
RepositoryForkNoVerifiedhttps://api.github.com/repos/nextauthjs/next-auth
RepositoryLicense (SPDX)ISCVerifiedhttps://api.github.com/repos/nextauthjs/next-auth
RepositoryDefault branchmainVerifiedhttps://api.github.com/repos/nextauthjs/next-auth
RepositoryCreated2018-01-27Verifiedhttps://api.github.com/repos/nextauthjs/next-auth
RepositoryLast push (any branch)2026-07-22Verifiedhttps://api.github.com/repos/nextauthjs/next-authMoves on a push to any branch; not used as a maintenance signal.
RepositoryMetadata updated2026-10-31Verifiedhttps://api.github.com/repos/nextauthjs/next-authMoves on metadata edits; not used as a maintenance signal.
AttentionStars28,375Verifiedhttps://api.github.com/repos/nextauthjs/next-auth
AttentionForks4,028Verifiedhttps://api.github.com/repos/nextauthjs/next-auth
AttentionWatchers (subscribers)112Verifiedhttps://api.github.com/repos/nextauthjs/next-auth
RepositoryOpen issues + pull requests603Verifiedhttps://api.github.com/repos/nextauthjs/next-authGitHub includes open pull requests in this count.
ActivityLatest default-branch commit2026-07-22Verifiedhttps://api.github.com/repos/nextauthjs/next-auth/commits?sha=main&per_page=100
ActivityLatest non-bot commit2026-07-22Verifiedhttps://api.github.com/repos/nextauthjs/next-auth/commits?sha=main&per_page=100
ActivityCommits, last 13 weeks0Verifiedhttps://api.github.com/repos/nextauthjs/next-auth/stats/commit_activityAll commits on the default branch, including bot commits.
ActivityHuman contributors, last 90 days0Verifiedhttps://api.github.com/repos/nextauthjs/next-auth/commits?sha=main&since=2026-05-04T00%3A00%3A00.000Z&per_page=100Window 2026-05-04 → 2026-10-31Counts distinct non-bot commit authors on the default branch. Co-authors and non-commit contributions are not counted.
ActivityHuman commits, last 90 days0Verifiedhttps://api.github.com/repos/nextauthjs/next-auth/commits?sha=main&since=2026-05-04T00%3A00%3A00.000Z&per_page=100Window 2026-05-04 → 2026-10-31Counts distinct non-bot commit authors on the default branch. Co-authors and non-commit contributions are not counted.
ActivityBot commits, last 90 days0Verifiedhttps://api.github.com/repos/nextauthjs/next-auth/commits?sha=main&since=2026-05-04T00%3A00%3A00.000Z&per_page=100Window 2026-05-04 → 2026-10-31Counts distinct non-bot commit authors on the default branch. Co-authors and non-commit contributions are not counted.
ReleasesReleases, last 365 days62Verifiedhttps://api.github.com/repos/nextauthjs/next-auth/releases?per_page=100GitHub releases only. Projects that publish solely to a package registry show none here. Lower bound: pagination stopped at a cap.
ReleasesLatest stable releasenext-auth@4.24.15 (2026-07-20)Verifiedhttps://api.github.com/repos/nextauthjs/next-auth/releases?per_page=100GitHub releases only. Projects that publish solely to a package registry show none here. Lower bound: pagination stopped at a cap.
CommunityGitHub community profile100%Verifiedhttps://api.github.com/repos/nextauthjs/next-auth/community/profileDetects files in the default locations GitHub checks.
SecuritySecurity policyYesVerifiedhttps://api.github.com/graphqlIncludes a policy inherited from the owner's .github repository.
npm · next-authLatest version4.24.15Verifiedhttps://registry.npmjs.org/next-auth/latestThe manifest of the version tagged `latest`, which may be a prerelease.
npm · next-authDeprecatedNoVerifiedhttps://registry.npmjs.org/next-auth/latestThe manifest of the version tagged `latest`, which may be a prerelease.
npm · next-authManifest repositorygit+https://github.com/nextauthjs/next-auth.gitVerifiedhttps://registry.npmjs.org/next-auth/latestThe manifest of the version tagged `latest`, which may be a prerelease.
npm · next-authDownloads/day, last 90 days968,477Verifiedhttps://api.npmjs.org/downloads/range/2025-05-01:2026-10-30/next-authWindow 2025-05-01 → 2026-10-29Registry download counts include CI installs, mirrors, and bots. Gap days are excluded, not counted as zero.
npm · next-authDownloads/day, last 30 days1,164,948Verifiedhttps://api.npmjs.org/downloads/range/2025-05-01:2026-10-30/next-authWindow 2025-05-01 → 2026-10-29Registry download counts include CI installs, mirrors, and bots. Gap days are excluded, not counted as zero.
npm · @auth/coreLatest version0.41.3Verifiedhttps://registry.npmjs.org/@auth%2fcore/latestThe manifest of the version tagged `latest`, which may be a prerelease.
npm · @auth/coreDeprecatedNoVerifiedhttps://registry.npmjs.org/@auth%2fcore/latestThe manifest of the version tagged `latest`, which may be a prerelease.
npm · @auth/coreManifest repositorygit+https://github.com/nextauthjs/next-auth.gitVerifiedhttps://registry.npmjs.org/@auth%2fcore/latestThe manifest of the version tagged `latest`, which may be a prerelease.
npm · @auth/coreDownloads/day, last 90 days699,616Verifiedhttps://api.npmjs.org/downloads/range/2025-05-01:2026-10-30/@auth/coreWindow 2025-05-01 → 2026-10-29Registry download counts include CI installs, mirrors, and bots. Gap days are excluded, not counted as zero.
npm · @auth/coreDownloads/day, last 30 days834,910Verifiedhttps://api.npmjs.org/downloads/range/2025-05-01:2026-10-30/@auth/coreWindow 2025-05-01 → 2026-10-29Registry download counts include CI installs, mirrors, and bots. Gap days are excluded, not counted as zero.

Collected 2026-10-31T13:05:53.700Z · repofacts-status-v0 · repofacts-health-v1 · repofacts-momentum-v0 · repofacts-taxonomy-v1 · inputs d6cf68ad8fda

Scores are decision support, not a warranty, certification, or security audit. How RepoFacts scores repositories. Spot an error? Send a correction with a source.