authra-next-auth

Auth.js v5 OAuth provider for Authra (authorization code + PKCE).

Signing out a device in the Authra console revokes that access token. This package stores the token on the Auth.js JWT and re-checks GET /oauth/userinfo. A 401/403 returns null from the jwt callback so Auth.js clears the session cookie.

Install

npm install authra-next-auth next-auth

Usage

import NextAuth from "next-auth";
import Authra, { authraCallbacks } from "authra-next-auth";

export const { handlers, auth, signIn, signOut } = NextAuth({
  providers: [
    Authra({
      issuer: process.env.AUTHRA_ISSUER,
      clientId: process.env.AUTHRA_CLIENT_ID!,
      clientSecret: process.env.AUTHRA_CLIENT_SECRET!,
    }),
  ],
  callbacks: authraCallbacks({
    issuer: process.env.AUTHRA_ISSUER,
  }),
});

issuer is your Authra origin, for example https://authra2.vercel.app or http://localhost:3000.

Register this callback on the Authra environment:

{AUTH_URL}/api/auth/callback/authra

Revalidation runs at most every 30 seconds (AUTHRA_REVALIDATE_MS). Network errors and Authra 5xx responses keep the local session. Sessions created before this helper was installed have no stored access token and are not remotely revoked until the user signs in again.

If the client uses SessionProvider, set refetchInterval to 30 (seconds) so the browser picks up a remote sign-out without a full reload.

Publish

GitHub Actions publishes this package when packages/authra-next-auth changes on main, or when you push a tag such as v0.2.2.

npm no longer lets 2FA-bypass tokens publish from CI. After the first version exists on npm, enable trusted publishing on the package:

• GitHub user fadhilx, repo authra2, workflow filename npm-package.yml, no environment
• Allow npm publish

Do not set NPM_TOKEN on the publish job. The workflow authenticates with OIDC (id-token: write).