Auth.js vs CIAM: When a Next.js Library Is Enough
Updated 2026-08-19 · 8 min read · By @guptadeepak
Key takeaways
- Auth.js is application code. CIAM is a platform with admin, audit, SSO, and recovery as products.
- Stay on a library if you have one Next.js app, a database you own, and no enterprise SSO on the roadmap.
- Better Auth is the 2026 library most new TypeScript apps should evaluate before Auth.js.
- Buy CIAM when Organizations, SCIM, passkey orchestration, or a compliance PDF show up.
- SuperTokens sits between library and SaaS: you can self-host the core and still get session primitives.
Auth.js is not missing from the vendor index by accident. It is not a vendor. This page is the first-class entry for the query anyway, because that is what Next.js teams type.
Library vs platform
A library (Auth.js, Better Auth, Passport, Lucia's successors) issues sessions in your process and writes users to your database. You own recovery, admin, audit, rate limits, and the SAML connector when a customer asks.
A CIAM platform (Clerk, Auth0, Stytch, SuperTokens Cloud) sells those unhappy paths as product. You pay MAU or a host bill so that account takeover is not a side project.
The build vs buy guide is the TCO version of this split. This page is the Next.js version.
When the library is enough
- One app, one user table, social login plus magic link or password.
- You will write the admin user search.
- Enterprise SSO is not on this year's roadmap.
- You are willing to own WebAuthn if passkeys matter. See passkeys in Next.js.
For new TypeScript work in 2026, evaluate Better Auth before Auth.js. The ecosystem argument for Auth.js is real. The API argument has moved.
When to buy
- A customer just asked for SAML. That is WorkOS or Clerk Organizations or Auth0, not an Auth.js provider you found on GitHub.
- You need a SOC 2 evidence pack that includes auth as a vendor.
- You want passkey orchestration, not a WebAuthn tutorial. Stytch or Descope.
- You have two apps and one user. Libraries do not become directories by wishing.
SuperTokens is the middle: core you can self-host, sessions as a product, not as a JWT helper.
Do not do this
Do not run Auth.js and Clerk in the same app.
Do not tell an enterprise buyer "we use NextAuth" and expect that to pass security review.
Do not treat a library SOC 2 as a thing. There isn't one. Your app's SOC 2 may cover it if you attest the control. That is your evidence, not Auth.js's.
Related vendors
Auth0
Auth0 remains the safest mid-market default for B2C plus B2B Enterprise SSO when developer velocity matters more than long-run TCO. Auth0 for AI Agents (GA November 2025) and Auth for MCP (GA May 2026) make it the first major CIAM with a packaged agent-identity surface. Below 50k MAU it is still hard to beat. Above 500k MAU, cost and Actions-driven lock-in make FusionAuth, Cognito, or Stytch (Twilio) plus a passkey orchestrator the more honest shortlist.
BetterAuth
BetterAuth is the most-discussed code-first OSS auth library in the TypeScript ecosystem in 2026, strict MIT, bring-your-own-database, plugin-architecture extensible, and a DX that feels like a modern framework primitive rather than a SaaS. The trade-off is that without a managed offering, the team owns the operational burden, the compliance story, and the production runtime. For teams that want auth as a library rather than a service, BetterAuth is a strong default; for teams that want managed compliance and SLAs, look elsewhere.
Clerk
Clerk is the default for native Next.js and Node.js apps under 100k MAU. Drop-in UI is the win. It is not an enterprise CIAM: federation long tail, Java/.NET, FedRAMP, and ISO 27001 are missing or thin. Do not put Clerk on an RFP that needs the rest of the enterprise stack. For that job use Auth0, WorkOS, or SSOJet. For passwordless-native, use MojoAuth or Stytch.
Stack Auth
Stack Auth is a 2023-vintage open-source alternative to Clerk for Next.js teams who want strict MIT licensing and self-host as an option. The DX is at the developer-first tier; the breadth of compliance, SDK coverage, and enterprise federation is not. For Next.js startups under 50k MAU prioritizing OSS guarantees, Stack Auth is a credible pick alongside Clerk and Kinde.
SuperTokens
SuperTokens is the modern OSS auth library with the cleanest pluggable architecture in 2026, Apache 2.0 self-hosted Core, Recipe-based composition (each auth method is a module), and strong session management primitives. For teams that want OSS auth as a library with optional managed offering, SuperTokens shortlists alongside FusionAuth and Zitadel. The trade-off is narrower compliance and weaker B2B Organizations than dedicated B2B platforms.
Where to next
FAQ
- Is Auth.js a CIAM vendor?
- No. Auth.js (formerly NextAuth.js) is an open-source authentication library that runs inside your Next.js (or similar) app. There is no Auth.js cloud, no MAU bill, and no SOC 2. SuperTokens, Clerk, and Auth0 are CIAM products. Better Auth is the 2024-2026 library that most new TypeScript apps compare against Auth.js.
- Should I use Auth.js or Clerk in 2026?
- Clerk if you want drop-in UI, Organizations, and someone else to own recovery. Auth.js or Better Auth if you want the session in your database and you will staff the unhappy paths. Most product teams under a deadline should buy. Most platform teams that already have a user table can stay on a library until the first SAML customer.
- Auth.js vs Better Auth vs SuperTokens?
- Auth.js is the older, larger ecosystem. Better Auth is the cleaner TypeScript API and plugin model, and Compass treats it as the modern library default. SuperTokens is a service you can self-host, with stronger session and multi-tenant primitives than either library. Library vs service is the real fork, not the npm name.
- When does a library become a liability?
- The first enterprise SSO deal, the first SOC 2 evidence request that needs auth audit logs as a product, the first passkey rollout that is not a weekend spike, or the second app that needs the same users. That is the buy-CIAM trigger. Do not wait for the third.
Sources
- Auth.js documentation (authjs.dev)
- Better Auth documentation
- CIAM Compass build vs buy guide
- CIAM Compass SuperTokens and Better Auth vendor profiles, last verified 2026