NextAuth.js is the established name for the Next.js integration of Auth.js. It handles provider sign-in flows, callback endpoints, CSRF protections, cookies, and session retrieval. It does not automatically implement registration, password resets, your user database, roles, or application-specific permissions.

This tutorial's runnable main path targets NextAuth v4 with the Pages Router (pages/). It demonstrates Google OAuth and a Credentials provider that delegates password verification to a trusted backend. A later chapter explains v5/App Router differences.

Authentication establishes who the user is. Authorization decides what that user may access or change. A valid session does not automatically grant permission to every resource. Enforce permissions on the server for protected pages, API routes, and mutations; hiding a button in React is not security.

Check your installed package with npm ls next-auth. The main examples use v4: pages/api/auth/[...nextauth].js, NextAuth(authOptions), getServerSession(req, res, authOptions), and callbackUrl. Auth.js v5 commonly uses auth.ts, exports handlers and auth, and uses auth() in server contexts. Do not mix snippets across major versions.

A provider verifies identity; callbacks apply policy and shape token/session data; the browser receives a protected session cookie; UI hooks read safe session data; server checks authorize access.