# authjs Source: https://startwithidentity.com/vendors/open-source/authjs/ Last updated: 2026-09-20 License: content by Start with Identity. Cite the source URL. --- ## Overview Auth.js, formerly NextAuth.js and still widely known by that name, is the long-standing open-source authentication library for JavaScript and TypeScript applications. It ships more than 80 preconfigured OAuth providers, 24 database adapters and integrations for Next.js, SvelteKit, Express, Qwik and SolidStart, under an ISC licence. Two facts change how it should be evaluated in 2026. First, maintenance [transferred to the Better Auth team](https://better-auth.com/blog/authjs-joins-better-auth) on 22 September 2025, and Vercel then acquired Better Auth in July 2026, so both projects now share an owner. Second, and more practically: **next-auth v5 has never shipped stable.** The npm latest tag is 4.24.15; v5 remains at 5.0.0-beta.32 after four years in beta. ## What it is good at Provider breadth and familiarity. Eighty-plus OAuth integrations is more than most competitors, the adapter list covers essentially every common database, and the volume of existing tutorials, Stack Overflow answers and example repositories is unmatched in the JavaScript ecosystem. At 4.41 million weekly npm downloads it remains deeply embedded. Session handling is flexible, supporting stateless JWT sessions with no database at all or database-backed sessions through an adapter. For a straightforward social-login flow on Next.js, it still does the job with very little code. ## Where it falls short Feature coverage stops well short of enterprise requirements. There is no first-party MFA or TOTP, no organizations or multi-tenancy, no SAML, no SCIM and no built-in RBAC, and every one of the 80-plus providers is OAuth or OIDC. Passkeys exist only as an experimental provider in the beta line, explicitly not recommended for production. Project health is the larger concern. Funding is roughly 4,400 dollars a year in Open Collective donations, human contribution has been concentrated in three or four people, the last repository push at review time was July 2026, and the maintaining team now recommends new projects use Better Auth instead. The July 2026 advisory batch included two critical CVSS 9.1 issues, one a fail-open authentication bypass affecting only the v5 beta that many teams run in production. ## Pricing Free and open source under ISC. No paid tier, no hosted service, no SLA and no published compliance certification. Funded by donations. ## Best for, and who should look elsewhere Choose Auth.js for existing applications that work and need no enterprise features, where security patches are sufficient. Choose [Better Auth](https://startwithidentity.com/vendors/open-source/better-auth/) for new projects, since its own maintainers recommend it. Choose [Auth0](https://startwithidentity.com/vendors/ciam/auth0/), [WorkOS](https://startwithidentity.com/vendors/ciam/workos/) or [Clerk](https://startwithidentity.com/vendors/ciam/clerk/) when you need SAML, SCIM, an SLA and someone accountable. ## Bottom line The most widely deployed JavaScript auth library, now in security maintenance under Better Auth and Vercel, with a v5 that never shipped and enterprise gaps its own maintainers point elsewhere to fill.