Auth.js vs Supabase Auth
Auth.js and Supabase Auth both answer the same question: how do users sign in? The long-running open source auth layer formerly called NextAuth, mostly a thin wrapper around OAuth providers. Auth that ships inside Supabase, with users stored in your Postgres and row level security wired to the session. The real split is ownership: Auth.js runs inside your project and leaves the operational work with you, while Supabase Auth runs the hard parts as a service and takes a dependency in exchange.
Verdict
The real split is ownership: Auth.js runs inside your project and leaves the operational work with you, while Supabase Auth runs the hard parts as a service and takes a dependency in exchange.
Pick Auth.js if
- ✓Enormous library of OAuth providers configured with a few lines each.
- ✓Years of production usage mean most errors already have a forum answer.
- ✓Adapters let you keep sessions in whichever database you already chose.
Pick Supabase Auth if
- ✓The user table is a Postgres table, so foreign keys to it just work.
- ✓Row level security policies read the session directly, pushing authorization into the database.
- ✓One vendor for auth, storage and database keeps the moving parts low.
| Comparison | Auth.js | Supabase Auth |
|---|---|---|
| Pricing shape | Free and open source. Costs are whatever your identity providers and database charge. | Included with the Supabase project you already pay for, with additional cost only at higher active-user tiers. |
| Frameworks | Next.js, SvelteKit | Next.js, SvelteKit, Nuxt, React Native, Expo, Flutter |
| In one line | The long-running open source auth layer formerly called NextAuth, mostly a thin wrapper around OAuth providers. | Auth that ships inside Supabase, with users stored in your Postgres and row level security wired to the session. |
Pricing described qualitatively because published plans change often. Checked 2026-08-23. Confirm current terms on Auth.js and Supabase Auth.
Auth.js
Strengths
- ✓Enormous library of OAuth providers configured with a few lines each.
- ✓Years of production usage mean most errors already have a forum answer.
- ✓Adapters let you keep sessions in whichever database you already chose.
- ✓Stateless JWT sessions work without any session store at all.
Tradeoffs
- ✗Anything past OAuth, like invitations or roles, you design yourself.
- ✗Callback and adapter APIs have churned across major versions more than once.
- ✗Documentation lags the code, so reading the source becomes routine.
- ✗Debugging silent callback failures is a known rite of passage.
Supabase Auth
Strengths
- ✓The user table is a Postgres table, so foreign keys to it just work.
- ✓Row level security policies read the session directly, pushing authorization into the database.
- ✓One vendor for auth, storage and database keeps the moving parts low.
- ✓Client libraries for web and mobile share the same session model.
Tradeoffs
- ✗Bundled with Supabase, so adopting it usually means adopting the whole platform.
- ✗Auth schema lives in a managed namespace you cannot freely reshape.
- ✗Row level security is powerful but easy to get subtly wrong.
- ✗Self-hosting the full stack to escape the cloud is a real operations project.
Same pair, different context
Frequently asked questions
Is Auth.js or Supabase Auth better?
Neither is better in the abstract. The real split is ownership: Auth.js runs inside your project and leaves the operational work with you, while Supabase Auth runs the hard parts as a service and takes a dependency in exchange. The wrong choice here is usually recoverable, so weight speed of decision over certainty.
What is the main drawback of Auth.js?
Anything past OAuth, like invitations or roles, you design yourself. Callback and adapter APIs have churned across major versions more than once.
What is the main drawback of Supabase Auth?
Bundled with Supabase, so adopting it usually means adopting the whole platform. Auth schema lives in a managed namespace you cannot freely reshape.
Can you switch from one to the other later?
Usually, at a cost that grows with how much of your product leans on the authentication layer. Plan for it in the data model, not in the framework, and the switch stays survivable.