Social login
Users sign in to an application through Twitter/X using Auth.js’s standard provider configuration.
Auth.js · Const
Twitter is a built-in Auth.js OAuth provider. Add it to the providers array, configure its credentials through the standard environment variables, and use its Twitter callback URL.
How it works
Twitter is registered as a built-in Auth.js provider by placing it in the providers array. Auth.js now uses Twitter/X OAuth 2.0 by default, while the provider reference also documents an explicit version option for OAuth 2.0 configuration.
Syntax
function default(config): OAuthConfig<TwitterProfile>Parameters
| Name | Type | Description |
|---|---|---|
config | OAuthUserConfig<TwitterProfile> | Optional provider configuration, including OAuth client credentials and version settings. |
Returns
OAuthConfig<TwitterProfile>
Key points
- Current Auth.js configurations use Twitter/X OAuth 2.0 without needing to specify a version.
- The provider’s conventional environment variables are AUTH_TWITTER_ID and AUTH_TWITTER_SECRET.
- For the Next.js-style integration, register this callback URL with the Twitter application.
- The core reference documents an explicit OAuth 2.0 opt-in setting for configurations that use the provider directly.
- Twitter has a special OAuth 1.0 compatibility path among Auth.js’s built-in providers.
- The provider supplies defaults, so the standard provider export can be placed directly in the providers list.
Common mistakes
- Twitter/X OAuth 2.0 does not provide email support.
- For the legacy OAuth 1.0 flow, requesting an email requires enabling the corresponding application permission.
- The OAuth 1.0 flow returns OAuth tokens with different names, so database schemas must account for them when using an adapter.
Example: Configure Twitter authentication
import NextAuth from "next-auth"
import Twitter from "next-auth/providers/twitter"
export const { handlers, auth, signIn, signOut } = NextAuth({
providers: [Twitter],
})Register the Twitter provider in the Auth.js configuration; the provider reads AUTH_TWITTER_ID and AUTH_TWITTER_SECRET automatically.
When to use it
Core OAuth configuration
An application uses Auth.js Core and needs a Twitter provider with explicit client credentials.
OAuth 1.0 token persistence
An adapter-backed application must persist provider-specific OAuth 1.0 token fields.
Interview questions
QHow do you configure Twitter in Auth.js?
Add the imported Twitter provider to Auth.js’s providers array. With the current setup, Auth.js can infer the credentials from AUTH_TWITTER_ID and AUTH_TWITTER_SECRET.
Follow-up: How would you opt into OAuth 2.0 explicitly in the core provider configuration? Pass version: "2.0" alongside clientId and clientSecret.
QWhat callback URL does the Twitter provider use?
The callback path is /api/auth/callback/twitter for the Next.js-style setup. The provider identifier used by Auth.js is Twitter.
Follow-up: What limitation should be considered when relying on Twitter/X OAuth 2.0? Email is not currently supported by that flow.
QWhat token difference matters when using Twitter OAuth 1.0?
The provider reference describes Twitter as the only built-in provider using OAuth 1.0 and says that flow returns oauth_token and oauth_token_secret instead of access_token and refresh_token. Adapter-backed applications should include those values in their database schema.
Follow-up: What application setting is needed to obtain an email address with OAuth 1.0? Enable “Request email address from users” in the application permissions.
Related
TwitterProfileOAuthConfigOAuthUserConfigAuthprovidersAUTH_TWITTER_IDAUTH_TWITTER_SECRET