Supabase Auth vs AuthJS for Solo Developers

Quick Comparison

Supabase Auth Overview

Supabase Auth is the authentication layer of the Supabase platform. It supports email/password, magic links, phone auth, and social OAuth providers. The standout feature is Row Level Security integration: PostgreSQL policies reference auth.uid() to enforce access control at the database level, not in application code.

The free tier allows 50,000 MAU. User data lives in your PostgreSQL database in the auth schema, which you own and can query directly. The Supabase client handles session management, token refresh, and auth state automatically.

I use Supabase Auth in a project where the backend is entirely Supabase. Users sign in, RLS policies kick in, and every database query is automatically scoped to the authenticated user. No custom authorization middleware required.

AuthJS Overview

AuthJS (formerly NextAuth.js) is an open-source auth library for JavaScript frameworks. Official adapters exist for Next.js, SvelteKit, and Express. You configure OAuth providers, optionally connect a database adapter for persistent sessions, and AuthJS manages the OAuth flows, CSRF protection, and session cookies.

AuthJS is completely free with no usage limits. It supports over 60 OAuth providers: Google, GitHub, Discord, Twitch, Spotify, and dozens more. The callback system lets you customize tokens, sessions, and sign-in behavior in your application code.

I've used AuthJS in Next.js projects where the backend wasn't Supabase. Adding Google and GitHub sign-in took about 30 minutes. The useSession() hook provides auth state anywhere in the app. For web apps that need flexible, free auth, AuthJS delivers consistently.

Key Differences

Backend coupling. Supabase Auth is part of the Supabase platform. Choosing it means your database is Supabase PostgreSQL, your real-time is Supabase, and your storage is Supabase. AuthJS is independent. Use it with Prisma and PlanetScale, or Drizzle and Neon, or no database at all (JWT sessions). AuthJS doesn't care what your backend looks like.

Row Level Security. Supabase Auth's killer feature is RLS. Write a policy like auth.uid() = user_id, and your database enforces it on every query. This eliminates authorization bugs at the code level because the database handles access control. AuthJS doesn't integrate with your database's security layer. You write authorization checks in your application code.

Free tier. Supabase Auth gives you 50,000 MAU as part of the Supabase free tier. AuthJS has no limits at all, but you might pay for the database adapter you connect (e.g., a hosted database). In practice, both are free for most solo developers, but Supabase's 50,000 MAU limit exists while AuthJS's doesn't.

OAuth provider count. AuthJS supports 60+ providers. Supabase Auth supports about 20. If you need authentication through Twitch, Spotify, Notion, or other niche providers, AuthJS likely has an adapter. Supabase covers the major providers but not the long tail.

Magic links. Supabase Auth has built-in magic link authentication. Users enter their email, receive a link, click it, and they're logged in. No password needed. AuthJS supports email-based login through providers like Resend or Nodemailer, but the setup requires more configuration. Supabase's magic links work out of the box.

Session customization. AuthJS gives you callbacks to modify JWT tokens and session objects at every step. You can add custom claims, change session duration, and control sign-in behavior programmatically. Supabase Auth manages sessions through its client with less granular control. If you need custom session logic, AuthJS is more flexible.

Framework support. AuthJS works with Next.js, SvelteKit, and Express. Supabase Auth works with any framework through its JavaScript client, plus official libraries for React Native, Flutter, Swift, and Kotlin. Supabase has broader platform support, especially for mobile.

When to Choose Supabase Auth

• You're using Supabase for your database and backend
• Row Level Security for database-level access control is appealing
• Magic link authentication is a feature you want
• You're building for mobile (Supabase has React Native, Flutter, Swift SDKs)
• You want auth integrated with your database platform

When to Choose AuthJS

• You're using a non-Supabase backend (PlanetScale, Neon, your own Postgres)
• You need 60+ OAuth providers (Twitch, Spotify, Discord, etc.)
• Session and token customization via callbacks is important
• You want auth completely independent from your database choice
• You're building with Next.js and want the tightest framework integration

The Verdict

If you're using Supabase as your backend, use Supabase Auth. The RLS integration alone makes this decision easy. Having your database enforce access control based on the authenticated user is a powerful feature that eliminates bugs. Adding AuthJS on top of Supabase would mean losing this integration.

If you're NOT using Supabase, AuthJS is the stronger pick for Next.js and SvelteKit projects. It's free, supports more providers, and gives you more control over sessions and tokens. You're not coupled to any platform, and the callback system handles most customization needs.

My recommendation: let your backend choice drive this. Using Supabase? Use Supabase Auth. Using anything else? Use AuthJS. Both are excellent, and the right answer depends entirely on what's behind your frontend. Don't overthink it. Pick the one that fits your stack and move on to building your product.