---
source_url: "https://www.matthewswong.com/en/blog/nextauth-vs-clerk-comparison/"
title: "NextAuth vs Clerk: Authentication in Next.js Apps in 2025"
mirrored_at: 2026-08-11T01:03:03.168Z
host: www.matthewswong.com
cited_in_42a: true
mirror_canonical: "https://index.42a.ai/www.matthewswong.com/en/blog/nextauth-vs-clerk-comparison/index"
---
> **Original source:** https://www.matthewswong.com/en/blog/nextauth-vs-clerk-comparison/
[Skip to main content](#main-content)
[Home](/en/)[Experience](/en/experience/)[Education](/en/education/)
Projects2
[ProjectsProducts, client work, and experiments](/en/projects/)[Case StudiesReal problems, measurable outcomes](/en/case-studies/)
[Certifications](/en/certifications/)[Hackathons](/en/hackathons/)
Blog2
[Blog300+ articles on DevOps, ERP, and web dev](/en/blog/)[How This Site WorksThe stack and decisions behind this site](/en/architecture/)
[Contact](/en/contact/)
## Frequently Asked Questions
What is the fundamental architectural difference between Clerk and NextAuth?+
Clerk is a hosted identity platform where your user database, session store, and JWT signing keys live in Clerk's infrastructure — your app is a client of Clerk's API. NextAuth (Auth.js) is a session middleware library that you deploy alongside your own database, giving you full ownership of the user table, session tokens, and OAuth callback handlers.
How does setup time compare between Clerk and NextAuth for a new Next.js project?+
Clerk wins decisively on setup speed: install the SDK, add middleware, wrap the app in ClerkProvider, and drop in pre-built components like and — a working auth flow takes under an hour. NextAuth requires configuring adapters, database schemas for users, sessions, and accounts tables, choosing an OAuth provider, and handling session callbacks, which takes considerably longer.
What does Clerk's Pro plan cost, and when does it become expensive for a SaaS?+
Clerk is free up to 10,000 MAUs and then $25/month (billed monthly) for up to 50,000 Monthly Retained Users, with additional charges per MRU beyond that. B2B features like organization management and SSO cost an extra $100/month, meaning a B2B SaaS needing SSO across multiple organizations can face a significant bill before reaching product-market fit.
What MFA and security features does Clerk include that NextAuth does not?+
Clerk's Pro plan includes MFA (TOTP and SMS), passkeys, one enterprise SSO connection, organization management, bot detection, breach password checks, and IP reputation handling out of the box. NextAuth has no built-in MFA — you must implement it yourself using a TOTP library and additional database columns, and access token rotation, refresh token handling, and bot protection all require manual implementation.
Why might Clerk be a compliance problem for businesses in Indonesia or Southeast Asia?+
Clerk stores user data in the US by default, with EU region available only on Enterprise plans — there is no in-region option for Southeast Asia. For Indonesian businesses or any app handling sensitive PII with local data residency requirements, Clerk may not be compliant out of the box, whereas NextAuth with your own database gives you full control over where data is stored.
Web Dev
# NextAuth vs Clerk: Authentication in Next.js Apps in 2025
June 20259 min read
Web Dev
Web Dev
[Back to all posts](/en/blog/)
Auth.js v5 (the new NextAuth) hit stable in late 2024 as a near-complete rewrite. By September 2025, the Better Auth team had taken over Auth.js maintenance, and the library entered security-patch mode. Meanwhile, Clerk continued shipping features rapidly and now handles everything from MFA to passkeys to B2B organization management out of the box. The authentication landscape shifted significantly in 2025 — here's where each tool stands.
Dimension
Auth.js (NextAuth)
Clerk
Hosting model
Self-hosted, you own the database and sessions
Fully hosted, Clerk manages users and sessions
Pricing
Free, open source
Free tier then per-monthly-active-user pricing
Passkeys & MFA
Requires manual provider setup
Built-in out of the box
Maintenance status
In security-patch mode since the Better Auth team took over in September 2025
Actively shipping new features
B2B / organizations
Requires custom implementation
Native organization and multi-tenant support
Best fit
Teams wanting full control over their own user data
Teams wanting to ship auth fast without owning the infrastructure
## Architecture: Fundamentally Different Approaches
Clerk is a hosted identity platform, not a session library. Your user database, session store, and JWT signing keys live in Clerk's infrastructure. Your app is a client of Clerk's API. This means Clerk handles IP reputation, bot detection, breach password checks, and compliance infrastructure automatically. NextAuth (Auth.js) is the opposite: a session middleware library that you deploy alongside your own database. You own everything — the user table, session tokens, OAuth callback handlers.
### Setup Speed and Developer Experience
Clerk wins on setup speed, decisively. With Clerk, you install the SDK, add middleware, wrap your app in ClerkProvider, and drop in pre-built components like and . A working auth flow takes under an hour. NextAuth requires configuring adapters, database schemas (users, sessions, accounts tables), choosing and setting up an OAuth provider, and handling session callbacks. For a solo developer or small team with a launch deadline, this difference is significant.
```
Clerk (Hosted Platform) NextAuth / Auth.js (Self-hosted)
─────────────────────── ────────────────────────────────
Your App Your App
│ │
▼ ▼
ClerkProvider (SDK) auth.ts config (adapters, providers)
│ │
▼ ▼
Clerk API (hosted) Your Database (users/sessions tables)
│ │
├── User store ├── NextAuth JWT / database sessions
├── Session management ├── OAuth callbacks (you handle)
├── MFA / passkeys (included) ├── MFA (build it yourself)
└── Org management └── Token rotation (build it yourself)
Setup time: ~1 hour Setup time: ~4-8 hours
Cost at 50k MAU: $25/month Cost: database + email only
Data location: Clerk's servers Data location: your infrastructure
Compliance: check their ToS Compliance: you control everything
```
From building a SaaS prototype with Clerk: use Clerk's Webhook sync to keep your own database in sync with Clerk's user records. When a user is created or updated in Clerk, the webhook fires and your NestJS or Next.js API handler upserts the record in your PostgreSQL database. This way you can still do relational queries against your own user data without querying Clerk's API on every request.
## Pricing: Where Clerk Gets Expensive
NextAuth is free — you pay only for your database and email provider. Clerk's pricing starts free (up to 10,000 MAUs) and then scales to $25/month (Pro, billed monthly) for 50,000 Monthly Retained Users. Beyond that, you pay per additional MRU. B2B features — organization management, SSO — are $100/month extra. For a consumer app that hits 50,000 users, Clerk's cost is manageable. For a B2B SaaS with multiple organizations needing SSO, the bill can grow significantly before you've achieved product-market fit.
```
// Clerk setup (minimal)
// middleware.ts
import { clerkMiddleware } from '@clerk/nextjs/server'
export default clerkMiddleware()
export const config = { matcher: ['/((?!_next|.*\..*).*)'] }
// app/layout.tsx
import { ClerkProvider } from '@clerk/nextjs'
export default function Layout({ children }) {
return {children}
}
// Protected page — done
import { auth } from '@clerk/nextjs/server'
export default async function Dashboard() {
const { userId } = await auth()
if (!userId) redirect('/sign-in')
return Dashboard for {userId}
}
// ─────────────────────────────────────────
// Auth.js v5 (NextAuth) setup
// auth.ts
import NextAuth from "next-auth"
import { PrismaAdapter } from "@auth/prisma-adapter"
import GitHub from "next-auth/providers/github"
import { prisma } from "@/lib/db"
export const { handlers, auth, signIn, signOut } = NextAuth({
adapter: PrismaAdapter(prisma),
providers: [GitHub],
// also need: DATABASE_URL, GITHUB_ID, GITHUB_SECRET, AUTH_SECRET env vars
// also need: prisma schema with User, Account, Session, VerificationToken tables
})
```
### Features: What Clerk Includes Out-of-Box
Clerk's Pro plan includes MFA (TOTP, SMS), passkeys, 1 enterprise SSO connection, and organization management. NextAuth has no built-in MFA — you implement it yourself with a TOTP library and database columns. Access token rotation, refresh token handling, and bot protection all require manual implementation in NextAuth. If you need these features and don't want to build them, Clerk is the faster path.
Clerk stores user data in the US by default (EU region available on Enterprise plans). For Indonesian or Southeast Asian businesses with data residency requirements, or for any app handling sensitive PII that must stay in-region, Clerk may not be compliant out of the box. NextAuth with your own database gives you full control over data locality. Check your regulatory requirements before choosing a hosted auth provider — this is a decision that's painful to reverse.
## NextAuth Auth.js v5: What Changed
Auth.js v5 was a major rewrite — universal runtime support (Edge, Node, Deno), a new unified config in auth.ts, and a cleaner TypeScript API. The adapter pattern improved significantly. However, with the Better Auth team taking over maintenance in late 2025, new Auth.js projects should evaluate Better Auth, which ships with more features and active development. For existing NextAuth v4 projects, v5 migration is well-documented but not urgent.
## What I Use and Why
For client projects where I control the budget and the user count stays under 50k, I use Clerk. The productivity gain during early-stage development is real — I'm not debugging OAuth callbacks when I should be building product features. For open-source projects, internal tools, or any project where I want zero vendor dependency on auth, I use NextAuth/Auth.js with a PostgreSQL adapter. The data ownership matters when I'm building something long-term.
## Decision Framework
Choose Clerk if: you're building a consumer or B2C SaaS with straightforward auth needs, you value developer velocity, you need MFA and passkeys without custom implementation, and your user count justifies the cost. Choose NextAuth/Auth.js if: you need full data ownership, you have strict data residency requirements, you're building open-source software, or you're on a zero-budget project. The authentication choice is a business decision as much as a technical one — model out the total cost at your expected user scale before committing.
### Sources & Further Reading
- [Wappalyzer — Clerk vs NextAuth.js Feature and Pricing Comparison — https://www.wappalyzer.com/compare/clerk-vs-nextauth-js/](https://www.wappalyzer.com/compare/clerk-vs-nextauth-js/)
- [StarterPick Blog — Better Auth vs Clerk vs NextAuth: 2026 SaaS Showdown — https://starterpick.com/blog/better-auth-clerk-nextauth-saas-showdown-2026](https://starterpick.com/blog/better-auth-clerk-nextauth-saas-showdown-2026)
- [Clerk — User Authentication for Next.js: Top Tools 2025 — https://clerk.com/articles/user-authentication-for-nextjs-top-tools-and-recommendations-for-2025](https://clerk.com/articles/user-authentication-for-nextjs-top-tools-and-recommendations-for-2025)
## Related Articles
- [Next.js Middleware: Real Use Cases Including Auth Guards](/en/blog/nextjs-middleware-real-use-cases/)
- [Building a SaaS in 30 Days with Next.js and Tailwind](/en/blog/build-saas-30-days-nextjs-tailwind/)