Auth.js · Function

auth

Auth.js’s Next.js auth function is a universal server-side authentication API. Export it from NextAuth configuration, call it to read the session, or use it to wrap handlers and inspect request authentication.

Since: v5

How it works

In a Next.js application, NextAuth returns an auth function from the central configuration. Calling it without arguments reads the current session, while wrapping a route handler exposes the session as req.auth; the same universal method can be used across middleware, server components, route handlers, and API routes.

Syntax

const { auth } = NextAuth(config)
const session = await auth()
export const GET = auth(handler)

Returns

Session or null when called without arguments; wrapped request handlers receive req.auth containing the authenticated user or token, if any.

Key points

auth provides one shared Next.js API for working with the current authentication state.
The function is designed for middleware, server components, app route handlers, and both Edge and Node API routes.
NextAuth returns auth alongside other helpers, so export it from the central configuration file.
Calling auth with no arguments asynchronously retrieves the current session for server-side code.
The authenticated request value may be a Session or null, depending on whether a user or token is present.

Common mistakes

Route protection decisions are handled through the authorized callback, so configure that callback when authentication should allow or deny access.
When auth wraps an API route handler, inspect req.auth rather than expecting the session as a separate argument.

Example: Read a session in a server component

import NextAuth from "next-auth"
import GitHub from "next-auth/providers/github"

export const { handlers, auth } = NextAuth({
  providers: [GitHub],
})

export default async function Page() {
  const session = await auth()
  return <p>{session ? `Signed in as ${session.user?.name}` : "Not signed in"}</p>
}

Initialize Auth.js in the root configuration and call the exported auth function in a server component.

When to use it

Server component session access

Read the current user or session in server-rendered application code.

Route-handler authentication

Protect or authenticate an app route, Edge route, or Node API route.

Middleware authorization

Apply authentication-aware behavior in Next.js middleware.

Interview questions

QWhat is the purpose of auth in Auth.js for Next.js?

auth is the universal Next.js method returned by NextAuth. It can be used in middleware, server components, route handlers, and Edge or Node.js API routes to access authentication state.

Follow-up: How can an API route use it? Wrap the handler with auth, then read the authenticated value from req.auth.

QHow is auth initialized and called?

Create an auth.ts configuration file, initialize NextAuth there, and export auth with the other returned helpers. Server-side code can then call await auth() to obtain the session.

Follow-up: Why centralize this configuration? The exported function is reusable across the supported Next.js execution contexts instead of requiring separate session APIs.

QHow does auth protect API routes?

For a route handler, auth can wrap the handler function. The request receives an auth property containing the authenticated user or token when available, or null otherwise.

Follow-up: How is general authorization configured? Auth.js performs authentication through the callbacks.authorized callback.

NextAuth
handlers
signIn
signOut
callbacks.authorized
Session

Source: Nextjs - Auth.js. Checked 2026-10-15.