Add Authentik sign-in
A Next.js application needs enterprise or self-hosted identity-provider login through an Authentik application.
Auth.js · Const
Authentik
Authentik is a built-in Auth.js provider for signing in through an Authentik OpenID Connect application. Configure its client credentials and issuer, then add it to the Auth.js providers list.
How it works
Authentik is a built-in Auth.js OpenID Connect provider. Add it to the providers list and supply its client credentials plus issuer; the issuer must identify the Authentik application slug without a trailing slash.
Syntax
Authentik({ clientId, clientSecret, issuer })Parameters
| Name | Type | Description |
|---|---|---|
options | OAuthUserConfig<P> | Configuration options for the Authentik OAuth provider, including client credentials and issuer. |
Returns
OAuthConfig<P>
Key points
- Auth.js includes Authentik as a built-in provider, so no custom provider definition is needed.
- The integration follows OpenID Connect assumptions unless its configuration is overridden.
- The documented environment-variable names provide the Authentik client ID, secret, and issuer.
- For the standard Next.js setup, register the Authentik callback at the documented API callback path.
- Provider options can override the built-in configuration for deployment-specific requirements.
Common mistakes
- Set the issuer to the Authentik application URL containing its slug, and omit the final slash.
Example: Configure Authentik with Next.js
import NextAuth from "next-auth";
import Authentik from "next-auth/providers/authentik";
export const { handlers, auth, signIn, signOut } = NextAuth({
providers: [
Authentik({
clientId: process.env.AUTH_AUTHENTIK_ID,
clientSecret: process.env.AUTH_AUTHENTIK_SECRET,
issuer: process.env.AUTH_AUTHENTIK_ISSUER,
}),
],
});Registers Authentik as an OpenID Connect provider in a Next.js Auth.js configuration.
When to use it
Customize provider settings
A deployment uses an Authentik application whose discovery endpoint differs from the provider defaults.
Configure a shared OIDC integration
An Authentik application is being connected to Auth.js across supported framework integrations.
Interview questions
QHow do you configure Authentik in Auth.js?
Authentik is configured by calling the built-in provider with clientId, clientSecret, and issuer, then placing the result in Auth.js's providers array. Auth.js treats the integration as OpenID Connect by default.
Follow-up: What must the issuer URL contain? It must include the Authentik application slug and must not end with a slash.
QWhat callback URL should an Authentik application use?
The callback endpoint uses the Authentik provider identifier: /api/auth/callback/authentik in the standard Next.js example. This URL must be registered with the Authentik application.
Follow-up: Why does the callback use authentik? The provider's built-in identifier determines the callback path segment.
QWhat does the Authentik provider factory return?
The provider accepts OAuthUserConfig options and returns an OAuthConfig. Its defaults can be customized when the built-in configuration does not match the deployment.
Follow-up: How can defaults be changed? Pass provider options in the Authentik call, using Auth.js's built-in provider customization approach.
Related
OAuthUserConfigOAuthConfigOpen ID Connectcustomizing a built-in OAuth providerNextAuth