Events vs Callbacks
Events such as signIn and signOut are suitable for audit logging and side effects. Use callbacks for allow/deny policy. Log only safe metadata such as user ID, provider, and outcome. Never log passwords, cookies, session tokens, or client secrets.
Safe audit event
events: {
async signIn({ user, account, isNewUser }) {
console.info("auth.signIn", {
userId: user?.id ?? null,
provider: account?.provider ?? null,
isNewUser: Boolean(isNewUser),
});
},
},💡 Use a structured logger and your organization's privacy policy; avoid unnecessary personal data.