Audit logging
Record sign-out activity for security reviews or compliance.
Auth.js · Enum
signOut event
The Auth.js signOut event is an asynchronous hook invoked during sign-out. Configure it for side effects such as audit logging, using a payload that reflects the active JWT or database session.
How it works
The signOut event handler runs asynchronously when Auth.js processes a user sign-out. Its message identifies the ended session using either the JWT token or the adapter-backed session, depending on the configured session strategy; event handlers are intended for side effects such as audit logging and do not produce a response.
Syntax
signOut: (message) => Awaitable<void>Parameters
| Name | Type | Description |
|---|---|---|
message | object | Event payload describing the sign-out context; it contains either a JWT token or the adapter session according to the session strategy. |
Returns
Awaitable<void>
Key points
- The event is declared as a callback receiving
messageand returning an awaitable with no meaningful result. - Use this hook for asynchronous side effects, especially recording sign-out activity.
- The payload is flow-dependent, so integrations should tolerate authentication-specific differences.
- Event payloads commonly expose identity information or token contents relevant to the event.
- Database-session configurations provide the adapter session that is being closed.
Common mistakes
- Treat the handler as a side-effect hook, not as a way to alter the sign-out response.
- Do not assume the message has the same fields for every authentication flow or session strategy.
- Read the JWT token for JWT sessions or the adapter session for database-backed sessions.
Example: Register a sign-out event handler
export const { handlers, auth } = NextAuth({
providers: [],
events: {
async signOut(message) {
console.log("Signed out", message)
},
},
})Register an asynchronous handler to record or otherwise react to a completed sign-out event.
When to use it
Operational telemetry
Send a notification or metric when a session ends.
Session cleanup
Clean up application-owned state associated with the ended session.
Interview questions
QWhat is the purpose of the Auth.js signOut event?
The signOut event is an asynchronous callback configured under events. Auth.js invokes it during sign-out, and event callbacks are useful for audit logging because they do not return a response.
Follow-up: What information can the callback receive? Its message varies by flow and commonly contains a user or token-related value; for sign-out, it contains a JWT token or the adapter session depending on the session strategy.
QWhat does the signOut event message contain?
The message represents the session being ended. With JWT sessions it contains the JWT, while with database-persisted sessions it contains the adapter session being terminated.
Follow-up: Why should code handle the two shapes? The configured session strategy determines which value is available, so a handler that assumes only one shape can fail or omit audit data.
QHow do you configure a signOut event handler?
Configure the callback in the Auth.js initialization object's events property, using an asynchronous function such as async signOut(message) { ... }. The handler should perform side effects like logging or sending an audit record.
Follow-up: Can the event handler change the redirect or returned result? No. Events do not return a response, so redirect behavior must be configured through the sign-out operation itself.
Related
eventssignInsessioncreateUserlinkAccountupdateUser