Passwordless authentication
Let users sign in without remembering a password by emailing a one-time verification link.
Auth.js · Const
Nodemailer
Nodemailer provides Auth.js email magic-link sign-in through an SMTP server. It sends verification-token links that sign users in or create their accounts, with a database required for token storage.
How it works
Nodemailer adds email-based magic-link authentication to Auth.js. Auth.js sends a verification token through an SMTP server; users follow the resulting link to sign in or create an account, while a database stores the verification token.
Syntax
Nodemailer(config: NodemailerUserConfig): NodemailerConfigParameters
| Name | Type | Description |
|---|---|---|
server | string | NodemailerOptions | SMTP connection string or Nodemailer configuration object used to connect to the mail server. |
from | string | Email address used as the sender of verification messages. |
Returns
A configured Auth.js Nodemailer provider configuration.
Key points
- It authenticates users through email links that carry verification tokens.
- The default verification-token lifetime is 24 hours.
- A first successful link use creates the account and signs the user in.
- For an existing email address, the link signs into its associated account.
- SMTP can be configured with either a connection string or a Nodemailer options object.
- An SMTP account is required, preferably from a service tested with Nodemailer.
Common mistakes
- A database is required even when sessions use JSON Web Tokens, because the email verification token must be stored.
- Install the Nodemailer package separately; it is not bundled with Auth.js.
- Configure a database adapter before enabling this provider.
Example: Nodemailer provider configuration
import NextAuth from "next-auth"
import Nodemailer from "next-auth/providers/nodemailer"
export const { handlers, auth, signIn, signOut } = NextAuth({
providers: [
Nodemailer({
server: process.env.EMAIL_SERVER,
from: process.env.EMAIL_FROM,
}),
],
})Configure Nodemailer with an SMTP connection string and sender address, then include it in Auth.js providers.
When to use it
OAuth account fallback
Offer email sign-in alongside OAuth providers as a recovery path when an OAuth account is unavailable.
SMTP email delivery
Use a conventional SMTP service while retaining Auth.js email-provider integration.
Interview questions
QHow does Nodemailer authentication work?
Nodemailer sends magic links containing verification tokens by email. The token is valid for 24 hours by default, and following the link signs in an existing user or creates a new account.
Follow-up: What infrastructure is mandatory? A database adapter must store the email verification token, even when using JWT-managed sessions.
QHow can the SMTP server be configured?
The provider accepts either an SMTP connection string or a Nodemailer configuration object for the server connection. The configuration also supplies the sender address through from.
Follow-up: When should another provider be preferred? For HTTP-based email services, Auth.js recommends providers such as Resend or Sendgrid.
QWhat prerequisites does the provider have?
Nodemailer is not installed by Auth.js, so the package must be added separately before configuring the provider. An SMTP account is also required.
Follow-up: What must be configured beyond the package? A database adapter is needed to persist email verification tokens.
Related
Email ProviderEmailConfigNodemailerConfigNodemailerUserConfigsendVerificationRequestVerification Tokendatabase adapter