Companies Using NextAuth.js

I run the crawling and detection systems at TechnologyChecker, and NextAuth.js is a library we only see because of what it does to a browser. As of our October 2026 crawl, 19,482 domains set its sign-in cookies and 10,596 match a company record, a 54.4% match rate. NextAuth.js is free and ISC-licensed, so this counts websites, not customers, and the way we see it limits what we can count.

What the cookies catch, and what they miss

NextAuth.js runs inside a Next.js app. When a page checks the session, usually a call to /api/auth/session as it loads, the library sets cookies, and our rule looks for two of them: __Host-next-auth.csrf-token and __Secure-next-auth.callback-url. Both names are documented in the NextAuth.js v4 options.

Three groups fall outside that rule. Auth.js v5, the rewrite, renamed the cookie prefix from next-auth to authjs, so v5 sites don't match. The __Host- and __Secure- prefixes only appear over HTTPS, because v4 drops them on plain HTTP. And a page that never calls the auth routes sets nothing. So 19,482 is a v4 floor. It's a big floor, though, because npm still serves version 4 as next-auth's latest release (4.24.15, published 20 July 2026), with v5 on a beta tag (5.0.0-beta.32).

Sales Signal: A company missing from this list may still run Auth.js v5, so don't read absence as "no NextAuth.js". Presence is the reliable signal: a domain here was on a v4 release when we last loaded it.

Growth trajectory

Our current crawl window shows 8,818 domains in June 2026, 11,134 in July, 16,285 in August, 19,475 in September and 19,482 in October. Counts are not a like-for-like series over time: the set of domains we crawl turns over every month, with dead sites dropping out and newly found ones added, and our detection signals widen over time. The steps reflect changes on our side, both the domains we cover and the signals we detect NextAuth.js with, rather than a surge in adoption. October's flat reading, up 7 domains, is one to watch. Sites moving to Auth.js v5 or Better Auth would leave this count, but one month can't separate that from ordinary turnover.

1,874 domains have lost the signal on at least one hostname since we began tracking it on 16 March 2026, and about one in ten of those still set it on another hostname. That's movement observed since March, not lifetime churn.

"Auth libraries are visible through side effects, and NextAuth.js renamed its side effect between versions. Any detector built on the old cookie names now counts one version, not the project." - David Thomson, CTO at TechnologyChecker.io

Sales Signal: Treat this list as the installed v4 base, and note the clock on it. In September 2025 the maintainers handed Auth.js to the Better Auth team, committed to security and urgent fixes, and recommended Better Auth for new work. Each team here will at some point weigh v5, Better Auth or a hosted service against staying put.

The companies behind the domains

The matched base leans small: 58.11% have 1-10 employees and 81.93% have 50 or fewer. Of companies with a founding year, 45.03% were founded in the 2020s and 30.43% in the 2010s. The large-company tail is real, with 299 companies above 1,000 employees, and we confirmed the cookies on live pages for many of the biggest names. Marks & Spencer, General Mills, Northrop Grumman, DocuSign, Royal Canin, Linklaters, Schroders and STADA load NextAuth.js on their main sites. Others keep it behind a portal: Zalando's partner.zalando.com, International SOS's myportal.internationalsos.com, Lincare's patient portal and Elavon's developer.elavon.com. Careers sites at Cartier and Kenya Airways carry it too.

Sales Signal: A main-site hit means a web platform team owns a Next.js app with authentication built in, and that team buys identity, security and observability tooling. A portal hit points to a product team. A careers-site hit may belong to a recruiting vendor, so check before you pitch.

Industry and geography

Technology, Information and Internet (9.53%), Software Development (9.24%) and IT Services (5.38%) make up 24.15% of matched companies. Financial Services comes next at 3.61%, ahead of Retail (2.98%) and Real Estate (2.79%). The United States leads with 2,475 matched companies, about 3.2 times India's 780, with Brazil (652) and the United Kingdom (581) behind. Indonesia (169) and Turkey (146) both make the top fifteen.

Sales Signal: Financial services is where an auth library's maintenance status matters most to a compliance team. With 364 financial services companies in the matched set, the Better Auth transition is a concrete reason to open that conversation.

Why this profile has no migration table

We tested NextAuth.js against Firebase, Supabase, Clerk, Auth0 and Okta, and every corridor failed our gates: most domains that ever had both still run both. The provider list explains part of that. NextAuth.js can sign users in through Auth0, Okta and Amazon Cognito, so a site running two of these may be using one inside the other. Today 369 domains run NextAuth.js with Firebase, 132 with Supabase, 46 with Auth0 and 28 with Clerk. Those are stacks, not switches.

"Two auth products on one domain often means one is the identity provider and the other runs the session. Counting that as a switch would invent churn that never happened." - David Thomson, CTO at TechnologyChecker.io

Sales Signal: Pitch hosted identity to these teams as an upgrade path, not a rescue. The overlap with Clerk and Auth0 is small, so for most of the 19,482 the decision is still open.

Reading the stack

Next.js runs on 98.02% of NextAuth.js domains, Tailwind CSS on 78.61%, Radix UI on 35.35% and shadcn/ui on 26.41%. Vercel hosts 40.41% and Amazon Web Services 16.00%. The Nuxt.js slice (2.10%) has a likely explanation: sidebase's nuxt-auth module installs next-auth as the engine of its AuthJS provider. These percentages are of the 19,536 domains in the clean live set, not the headline.

Sales Signal: This is a coherent buyer: React developers on Next.js, often deployed on Vercel and styled with Tailwind CSS. Developer tools that integrate with Vercel, and auth vendors with a Next.js SDK, can treat the list as pre-qualified.

How to use this list

Filter NextAuth.js to companies with 51 or more employees to move past solo builders; that band holds 18.07% of matched companies with a size, 1,862 in all. Then read the detection URL to tell a main site from a portal.

A workable opener: "Your sign-in on [surface] runs on NextAuth.js v4. Since Auth.js joined Better Auth in September 2025, the maintainers have committed to security and urgent fixes and recommend Better Auth for new projects. If you're planning the next step, here's how [product] fits."

Export the list from all 19,482 NextAuth.js domains and 10,596 matched companies on TechnologyChecker.io.