Download websites that use NextAuth.js

About NextAuth.js

Authentication is the part of a web application that nobody sees and everybody depends on, which is why a library like NextAuth.js is worth tracking as a stack signal rather than as a product. Arriving in 2020, the library gave Next.js teams a way to accept sign-ins from OAuth providers, email links and their own credential stores without hand-rolling session handling, token rotation and cross-site request protection. A team that adopted it made a deliberate architectural choice at the point where user accounts enter the system.

That choice is what a researcher is really buying when they take the list. Sites in this population are almost always modern JavaScript applications with server rendering, a component build pipeline and a deployment story to match. Presence of an authentication layer also means the site has users, sessions and something behind the login worth protecting, which separates it from the large number of pages that are only brochures. Identity vendors, fraud and bot mitigation vendors, and anyone selling a developer tool that plugs into a session already treat this as the qualifying question. The Authentication classification is the shorthand, but the shape of the engineering team behind it is the interesting part.

Honesty about detection matters more here than usual. A library that runs on the server leaves thin traces, and we recognize it from client-side artifacts and the conventional endpoints it exposes rather than from anything the framework announces about itself. Applications that proxy those routes, rename them, or keep the whole flow on a separate hostname will be missed. Distributed under the ISC license and installed as a build dependency, the library never prints a version banner, so the count is a confident lower bound and not a complete inventory.

As of October 2026 the population stands at 636 sites. Because the library is young, the sites carrying it skew toward recent builds and rebuilds, which is useful when the question is what teams are choosing now rather than what the web accumulated over decades. Checking one domain tells you whether that domain is a fit. Only the full file lets you find the cohort, cross it against hosting, country and the analytics or payment tools sitting beside it, and decide whether the segment is large enough to justify a campaign or a product.