Map provider claims to Auth.js user fields
Normalize provider data
Auth.js · Type Alias
Profile
Profile is the user-information object returned by an OAuth provider. Auth.js makes it available for provider mapping and relevant callbacks, with OIDC profiles potentially coming from an ID token or user-info response.
How it works
Profile is the provider-specific user-information object returned during OAuth authentication. Auth.js exposes it to provider profile mapping and sign-in callbacks; for OIDC, it may come from the decoded ID token or the user-info response.
Syntax
type Profile = Record<string, any>Key points
- Profile describes the user-information object supplied by an OAuth provider.
- Auth.js exposes the OAuth profile to callback parameters.
- For OAuth sign-ins, the callback value contains the provider's full profile rather than only the normalized user fields.
- In the signIn callback, profile is available when the callback trigger is signIn.
Common mistakes
- For OIDC providers, the profile can originate from either the decoded ID token or the /userinfo response.
Example: Map an OAuth profile
import NextAuth from "next-auth";
export const { handlers, auth } = NextAuth({
providers: [
{
id: "example",
name: "Example",
type: "oauth",
clientId: process.env.AUTH_CLIENT_ID,
clientSecret: process.env.AUTH_CLIENT_SECRET,
issuer: "https://issuer.example.com",
profile(profile) {
return {
id: profile.sub,
name: profile.name,
email: profile.email,
image: profile.picture,
};
},
},
],
});Maps the provider's OAuth profile into the user fields Auth.js uses.
When to use it
Inspect provider claims in the signIn callback
Authorize sign-ins
Read claims from ID-token or user-info responses
Support OIDC providers
Interview questions
QWhat does Auth.js Profile represent?
Profile is the user information returned by an OAuth provider. In an OIDC flow, it can represent claims from the decoded ID token or the /userinfo response.
Follow-up: Where can it be used in callbacks? The signIn callback receives it as profile when the trigger is signIn, allowing provider data to influence authorization.
QHow is Profile mapped into a user?
A provider's profile callback transforms the provider response into the user data Auth.js uses. The default mapping includes name, email, and picture.
Follow-up: How would you preserve extra provider claims? Return those fields from the profile callback so they can be included in the resulting user object where supported.
QWhen is Profile available in callbacks?
The signIn callback can receive profile alongside account, user, session, token, and trigger. The profile value is available for an OAuth sign-in and can be inspected for authorization decisions.
Follow-up: What should be checked before relying on profile? Confirm the authentication flow is OAuth-based and account for provider-specific claim names and optional values.
Related
UserAccountOAuthConfigAuthConfigsignIn callback