With session: { strategy: "jwt" }, session state is represented by an encrypted token in a cookie. With strategy: "database", a session token references a server-side session record through an adapter. Adding an adapter can change the default strategy to database unless you explicitly set it. Credentials has limitations with database sessions in standard setups; verify compatibility for your exact version.