Authentication that stays inside your own app
Technology
NextAuth.js, now Auth.js, puts authentication in the application instead of behind a vendor's login page. It runs the OAuth exchange with the providers, signs and encrypts the session, and hands you a hook. The user table is yours, the callbacks are yours, and nothing redirects to a domain you do not control.
We shipped it on GoHealth Urgent Care, where a marketing site and a patient portal had to share one signed in state across two independent Next.js projects. Our engineer wrote up that configuration afterwards, rewrites and basePath and all, and it is still the post we send people.
Ownership
What you get, and what you take on
- One auth route can serve two applications
A marketing site and a portal can be separate Next.js projects under one domain, with only the portal holding the NextAuth API route while the site rewrites its auth paths to it. Both read the same session. That is the shape we shipped for GoHealth, with Turborepo sharing the config.
- You own the user store and the recovery path
There is no admin console, no support line, and no dashboard telling you a credential stuffing run is underway. Password reset, lockout, MFA enrollment and audit logging are yours to build or to bring from elsewhere. That is the real price of keeping the session in your app.
- It stops short of enterprise SSO
Adapters cover databases, not org charts. SAML federation, SCIM provisioning and per tenant connection management sit outside what the library sets out to do. When buyers start asking for those in a security review, a hosted identity provider is the shorter path, and that is fine.
