NextAuth.js

United States · next-auth.js.org · 4 vendors

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 4 sub-vendors.

Insights

Last updated 2026-08-05 · revision 1

4 direct vendors, 118 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 9/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

NextAuth.js demonstrates very high migration readiness due to its cutting-edge and flexible internal tech stack, including Node.js, TypeScript, and Next.js. Its design for Serverless/Edge Runtime compatibility, along with its open-source nature and extensive support for various OAuth providers and database adapters, signifies an architecture built for interoperability and minimal vendor lock-in at the product level. The explicit mention of "Total Vendors: 0" in the "Vendor Relationships" section, if interpreted as a lack of direct contractual vendors for its own operations, further suggests a low level of direct vendor lock-in for the company itself. This architectural flexibility and open-source model would significantly ease any potential migration efforts for NextAuth.js's own development and distribution infrastructure. The assessment is hampered by the absence of data concerning specific regulatory environments, data residency requirements, and the company's financial stability, all of which could influence the complexity and funding of a migration. While the product is highly flexible, the geographic concentration of its operational dependencies (e.g., GitHub, Vercel, both US-based) as implied by the "Internal Tech Stack" and the "Vendor Geographic Diversity: 2 unique countries" (Denmark, United States) for "4 services" from the "Vendor Relationships" section, could introduce some complexity if a complete migration of its development and distribution infrastructure were required to a different geographic region or set of platforms. The "Vendor Lock-in Risk" is "Unknown".

Compliance

5 in-scope frameworks identified; showing 3.

GDPR (source) — Assessment Required

NextAuth.js is an open-source authentication library (now under Better Auth Inc., a US-based entity) that is distributed globally and used by millions of applications worldwide — including major platforms like ChatGPT and Google Labs. As a software library/toolkit, NextAuth.js itself does not directly collect, store, or process end-user personal data; rather, it provides the infrastructure for developers to implement authentication. However, the project does maintain contributor data, GitHub interaction data, and npm download telemetry. The library's global reach means EU/EEA residents almost certainly interact with applications built on it. The risk is Medium rather than High because NextAuth.js is a developer tool (not a data controller of end-user data), but GDPR applicability to its own operational data (contributor PII, website analytics, etc.) and its role as a potential data processor in downstream applications warrants formal assessment. No DPO appointment or GDPR compliance documentation has been publicly disclosed.

Evidence: https://next-auth.js.org, https://next-auth.js.org/faq, https://github.com/nextauthjs/next-auth, https://better-auth.com/blog/authjs-joins-better-auth, https://gdpr-info.eu/art-3-gdpr/

ISO 27001 (source) — Assessment Required

ISO 27001 is an internationally recognized information security management standard. NextAuth.js / Better Auth Inc. manages a security-critical open-source project used by millions of applications globally. The project's GitHub repository, npm package distribution, and documentation infrastructure represent an information security attack surface — a compromised package or repository could have supply-chain security implications at massive scale (similar to the xz-utils or event-stream incidents). The absence of ISO 27001 certification means there is no independently verified ISMS governing the project's security practices. Risk is Medium because while the project demonstrates security-conscious design (encrypted JWTs, CSRF protection, OWASP alignment, responsible disclosure policy), the lack of formal ISMS certification is a gap for enterprise and regulated-industry adopters.

Evidence: https://next-auth.js.org/security, https://github.com/nextauthjs/next-auth/security, https://github.com/nextauthjs/next-auth, https://better-auth.com/enterprise, https://www.iso.org/standard/27001

CCPA — Assessment Required

Better Auth Inc. is a US-based company (copyright notice: 'NextAuth.js © Better Auth Inc. 2026') and NextAuth.js serves a global user base including California residents. CCPA applies to for-profit businesses that collect personal information from California consumers and meet one of three thresholds: (1) annual gross revenue over $25M, (2) buy/sell/receive/share personal information of 100,000+ consumers/households annually, or (3) derive 50%+ of annual revenue from selling personal information. Given the massive scale of NextAuth.js (28,300+ GitHub stars, millions of npm downloads, used by ChatGPT, Google Labs, Cal.com), threshold (2) is plausible. Risk is Medium because the commercial status and revenue of Better Auth Inc. are not publicly disclosed, making definitive assessment impossible.

Evidence: https://next-auth.js.org, https://better-auth.com/legal/privacy, https://better-auth.com/blog/authjs-joins-better-auth, https://oag.ca.gov/privacy/ccpa

Financials

Three-year financials

Financial Resilience Score: 6/10

NextAuth.js is an open-source project rather than a standalone commercial entity, so it has no independent revenue, EBIT, or equity to assess. Its financial resilience must be evaluated indirectly through its corporate stewards, which have transitioned from a community project to Better Auth Inc. and most recently to Vercel Inc. Vercel is a well-funded, privately held company with multiple large VC rounds from Accel, GV, and Bedrock, and reported estimates of ~$200M ARR and a ~$3.25B valuation at its 2024 Series E, though these figures are not from audited filings. The project benefits from significant ecosystem strength: ~6.7 million weekly npm downloads, 29k GitHub stars, and 900+ contributors, reducing key-person risk and providing a strong moat. Enterprise monetization pathways exist through Better Auth's paid dashboard, audit logs, Sentinel security detection, and SSO/SAML/SCIM features. However, the lack of standalone revenue, opaque financials of its parent entities, successive rebrands (NextAuth.js → Auth.js → Better Auth), and intense competition from Clerk, Auth0, Supabase Auth, Firebase Auth, WorkOS, and Stack Auth constrain the resilience assessment.

Key strengths: Very large user base with ~6.7M weekly npm downloads and 29k GitHub stars, Strategic ownership by Vercel, the commercial company behind Next.js, Well-funded parent with multiple large VC rounds (Accel, GV, Bedrock), Enterprise monetization path via Better Auth paid features (SSO/SAML/SCIM, audit logs), Strong community moat with 900+ contributors reducing key-person risk, De-facto authentication solution in the Next.js ecosystem

Risk factors: No standalone revenue - library is free and open-source, Opaque financials with no public filings from Better Auth or Vercel, Successive rebrands and governance transitions may fragment users, Intense competition from Clerk, Auth0/Okta, Supabase Auth, Firebase Auth, WorkOS, Stack Auth, Economic value accrues entirely to corporate steward, not the project itself, No audited financial statements available for due diligence

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report