---
title: "@playstack/auth-authjs"
description: "Router-neutral Auth.js callback bridge for Playstack identity and safe session projections."
tags: ["package","identity","authjs","nextjs","oauth","free"]
---

{/* package-access:start */}

> **Free.** MIT licensed. Check preview availability before installing. See [package access](/docs/packages#access-policy).

{/* package-access:end */}

`@playstack/auth-authjs` connects successful Auth.js provider callbacks to application-owned Playstack authentication. It does not configure providers, replace Auth.js routing, or create a second identity database.

{/* package-install:start */}

## Install

After confirming [preview access](/docs/packages#access-policy), install the package at your application's shared Playstack version:

```sh
npm install --save-exact @playstack/auth-authjs@0.1.0-beta.1
```

Check the peer requirements below before choosing a runtime or provider.

{/* package-install:end */}

## Configure the bridge

```ts
import { createAuthJsBridge } from '@playstack/auth-authjs'

const bridge = createAuthJsBridge({
  normalizeProfile: ({ provider, providerAccountId, profile }) => ({
    providerId: provider,
    providerUserId: providerAccountId,
    email: profile.email,
    emailVerified: profile.email_verified === true,
    raw: profile,
  }),
  authenticate: (profile) => auth.authenticateProfile(profile),
  resolveAccount: (userId) => activeAccountFor(userId),
  onAuthenticated: (user) => accounts.ensurePersonalAccount(user.id),
})
```

Attach `bridge.callbacks` to either an Auth.js Pages Router configuration or App Router factory. The bridge requires JWT sessions because its callback owns the encrypted Playstack principal.

`CredentialService.authenticateProfile()` is the canonical destination for
the normalized result. Use `authenticateProvider()` only when Playstack also
owns the authorization-code exchange. Both paths share the same verified-email,
identity-linking, reservation, transaction, and event rules.

## Boundary

Provider normalization and verified-email policy remain explicit. The session callback adds only `session.playstack`, an exact `AuthSessionView` without provider tokens or raw profile data. Provider handlers, cookies, middleware, and application module augmentation remain application-owned.

{/* package-reference:start */}

## API entry points and requirements

Reference snapshot: `@playstack/auth-authjs@0.1.0-beta.1`. Import only the entry point your runtime needs. Paths below are relative to the installed package; use **Go to Definition** in your editor to inspect exact parameters, return types and overloads. Do not import the declaration-file paths directly.

| Public entry point | Declaration file |
| --- | --- |
| `@playstack/auth-authjs` | `./dist/index.d.ts` |
| `@playstack/auth-authjs/errors` | `./dist/errors.d.ts` |
| `@playstack/auth-authjs/package.json` | No TypeScript declaration (asset or metadata export). |

Node.js engine requirement: `>=20`. This is not a claim that every entry point works in browsers or Workers.

### Peer dependencies

Keep existing framework versions that satisfy these ranges. Install optional peers only when using the corresponding adapter. The package manager resolves ordinary dependencies separately.

| Peer | Compatible range | When needed |
| --- | --- | --- |
| `@playstack/auth` | `0.1.0-beta.1` | Required by the package. |
| `@playstack/core` | `0.1.0-beta.1` | Required by the package. |
| `next-auth` | `>=4.24.0 <6` | Optional; only for the entry points that use it. |

For a complete first program, start with [Getting started](/docs/getting-started). For API lookup and partial-example conventions, see [Reading the reference](/docs/packages#reading-the-reference). Provider failures, lifecycle requirements and application responsibilities remain described in the guide above; types alone do not establish production safety.

{/* package-reference:end */}