`jwt`: Store Selected Claims
With JWT sessions, jwt runs at initial sign-in and when the token is processed later. At initial sign-in, user and account may be present; later calls may only have the existing token. Add only necessary claims such as stable user ID, role, or provider. Never store passwords, password hashes, or secrets.
JWT callback
callbacks: {
async jwt({ token, user, account }) {
if (user) {
token.userId = user.id;
if (user.role) token.role = user.role;
}
if (account) token.provider = account.provider;
return token;
},
},💡 NextAuth's default JWT session token is encrypted as JWE. Do not assume it is a plain three-part signed JWT.