With session: { strategy: "jwt" }, session state is represented by an encrypted token in a cookie. With strategy: "database", a session token references a server-side session record through an adapter. Adding an adapter can change the default strategy to database unless you explicitly set it. Credentials has limitations with database sessions in standard setups; verify compatibility for your exact version.

Without a database adapter, NextAuth can establish a JWT session but does not create a durable application user record for you. If you need roles, organizations, billing, or audit history, persist users in your own database or use a supported adapter. An adapter maps Auth.js users/accounts/sessions to database records; it does not implement password hashing or registration for you.

A user may sign in with Google and later use a password for the same email. Decide whether these identities represent one account. Safe linking generally requires authenticating the existing account and deliberately linking the second provider, or a carefully reviewed verified-email policy. Never link accounts solely on a user-submitted email address; consider provider subject IDs, verified email status, recovery, and duplicate-email handling.