# NextAuth vs Clerk: Authentication in Next.js Apps in 2025
> A real comparison of NextAuth.js and Clerk for Next.js authentication — pricing, DX, features, and when each makes sense for your project.
URL: https://www.matthewswong.com/en/blog/nextauth-vs-clerk-comparison/
- Author: Matthews Wong (https://www.matthewswong.com/en/about/)
- Published: 2025-06-10
- Updated: 2025-06-10
- Category: Web Dev
Auth.js v5 (the new NextAuth) hit stable in late 2024 as a near-complete rewrite. By September 2025, the Better Auth team had taken over Auth.js maintenance, and the library entered security-patch mode. Meanwhile, Clerk continued shipping features rapidly and now handles everything from MFA to passkeys to B2B organization management out of the box. The authentication landscape shifted significantly in 2025 — here's where each tool stands.
## Architecture: Fundamentally Different Approaches
Clerk is a hosted identity platform, not a session library. Your user database, session store, and JWT signing keys live in Clerk's infrastructure. Your app is a client of Clerk's API. This means Clerk handles IP reputation, bot detection, breach password checks, and compliance infrastructure automatically. NextAuth (Auth.js) is the opposite: a session middleware library that you deploy alongside your own database. You own everything — the user table, session tokens, OAuth callback handlers.
### Setup Speed and Developer Experience
Clerk wins on setup speed, decisively. With Clerk, you install the SDK, add middleware, wrap your app in ClerkProvider, and drop in pre-built components like and . A working auth flow takes under an hour. NextAuth requires configuring adapters, database schemas (users, sessions, accounts tables), choosing and setting up an OAuth provider, and handling session callbacks. For a solo developer or small team with a launch deadline, this difference is significant.
> From building a SaaS prototype with Clerk: use Clerk's Webhook sync to keep your own database in sync with Clerk's user records. When a user is created or updated in Clerk, the webhook fires and your NestJS or Next.js API handler upserts the record in your PostgreSQL database. This way you can still do relational queries against your own user data without querying Clerk's API on every request.
## Pricing: Where Clerk Gets Expensive
NextAuth is free — you pay only for your database and email provider. Clerk's pricing starts free (up to 10,000 MAUs) and then scales to $25/month (Pro, billed monthly) for 50,000 Monthly Retained Users. Beyond that, you pay per additional MRU. B2B features — organization management, SSO — are $100/month extra. For a consumer app that hits 50,000 users, Clerk's cost is manageable. For a B2B SaaS with multiple organizations needing SSO, the bill can grow significantly before you've achieved product-market fit.
### Features: What Clerk Includes Out-of-Box
Clerk's Pro plan includes MFA (TOTP, SMS), passkeys, 1 enterprise SSO connection, and organization management. NextAuth has no built-in MFA — you implement it yourself with a TOTP library and database columns. Access token rotation, refresh token handling, and bot protection all require manual implementation in NextAuth. If you need these features and don't want to build them, Clerk is the faster path.
> **Data Residency and Compliance Implications**
> Clerk stores user data in the US by default (EU region available on Enterprise plans). For Indonesian or Southeast Asian businesses with data residency requirements, or for any app handling sensitive PII that must stay in-region, Clerk may not be compliant out of the box. NextAuth with your own database gives you full control over data locality. Check your regulatory requirements before choosing a hosted auth provider — this is a decision that's painful to reverse.
## NextAuth Auth.js v5: What Changed
Auth.js v5 was a major rewrite — universal runtime support (Edge, Node, Deno), a new unified config in auth.ts, and a cleaner TypeScript API. The adapter pattern improved significantly. However, with the Better Auth team taking over maintenance in late 2025, new Auth.js projects should evaluate Better Auth, which ships with more features and active development. For existing NextAuth v4 projects, v5 migration is well-documented but not urgent.
## What I Use and Why
For client projects where I control the budget and the user count stays under 50k, I use Clerk. The productivity gain during early-stage development is real — I'm not debugging OAuth callbacks when I should be building product features. For open-source projects, internal tools, or any project where I want zero vendor dependency on auth, I use NextAuth/Auth.js with a PostgreSQL adapter. The data ownership matters when I'm building something long-term.
## Decision Framework
Choose Clerk if: you're building a consumer or B2C SaaS with straightforward auth needs, you value developer velocity, you need MFA and passkeys without custom implementation, and your user count justifies the cost. Choose NextAuth/Auth.js if: you need full data ownership, you have strict data residency requirements, you're building open-source software, or you're on a zero-budget project. The authentication choice is a business decision as much as a technical one — model out the total cost at your expected user scale before committing.
## Sources & Further Reading
- Wappalyzer — Clerk vs NextAuth.js Feature and Pricing Comparison — https://www.wappalyzer.com/compare/clerk-vs-nextauth-js/
- StarterPick Blog — Better Auth vs Clerk vs NextAuth: 2026 SaaS Showdown — https://starterpick.com/blog/better-auth-clerk-nextauth-saas-showdown-2026
- Clerk — User Authentication for Next.js: Top Tools 2025 — https://clerk.com/articles/user-authentication-for-nextjs-top-tools-and-recommendations-for-2025
| Dimension | Auth.js (NextAuth) | Clerk |
| --- | --- | --- |
| Hosting model | Self-hosted, you own the database and sessions | Fully hosted, Clerk manages users and sessions |
| Pricing | Free, open source | Free tier then per-monthly-active-user pricing |
| Passkeys & MFA | Requires manual provider setup | Built-in out of the box |
| Maintenance status | In security-patch mode since the Better Auth team took over in September 2025 | Actively shipping new features |
| B2B / organizations | Requires custom implementation | Native organization and multi-tenant support |
| Best fit | Teams wanting full control over their own user data | Teams wanting to ship auth fast without owning the infrastructure |
## Source links
- https://www.wappalyzer.com/compare/clerk-vs-nextauth-js/
- https://starterpick.com/blog/better-auth-clerk-nextauth-saas-showdown-2026
- https://clerk.com/articles/user-authentication-for-nextjs-top-tools-and-recommendations-for-2025
## FAQ
### What is the fundamental architectural difference between Clerk and NextAuth?
Clerk is a hosted identity platform where your user database, session store, and JWT signing keys live in Clerk's infrastructure — your app is a client of Clerk's API. NextAuth (Auth.js) is a session middleware library that you deploy alongside your own database, giving you full ownership of the user table, session tokens, and OAuth callback handlers.
### How does setup time compare between Clerk and NextAuth for a new Next.js project?
Clerk wins decisively on setup speed: install the SDK, add middleware, wrap the app in ClerkProvider, and drop in pre-built components like and — a working auth flow takes under an hour. NextAuth requires configuring adapters, database schemas for users, sessions, and accounts tables, choosing an OAuth provider, and handling session callbacks, which takes considerably longer.
### What does Clerk's Pro plan cost, and when does it become expensive for a SaaS?
Clerk is free up to 10,000 MAUs and then $25/month (billed monthly) for up to 50,000 Monthly Retained Users, with additional charges per MRU beyond that. B2B features like organization management and SSO cost an extra $100/month, meaning a B2B SaaS needing SSO across multiple organizations can face a significant bill before reaching product-market fit.
### What MFA and security features does Clerk include that NextAuth does not?
Clerk's Pro plan includes MFA (TOTP and SMS), passkeys, one enterprise SSO connection, organization management, bot detection, breach password checks, and IP reputation handling out of the box. NextAuth has no built-in MFA — you must implement it yourself using a TOTP library and additional database columns, and access token rotation, refresh token handling, and bot protection all require manual implementation.
### Why might Clerk be a compliance problem for businesses in Indonesia or Southeast Asia?
Clerk stores user data in the US by default, with EU region available only on Enterprise plans — there is no in-region option for Southeast Asia. For Indonesian businesses or any app handling sensitive PII with local data residency requirements, Clerk may not be compliant out of the box, whereas NextAuth with your own database gives you full control over where data is stored.
---
- HTML version: https://www.matthewswong.com/en/blog/nextauth-vs-clerk-comparison/
- Bahasa Indonesia: https://www.matthewswong.com/id/blog/nextauth-vs-clerk-comparison/
- Site index for agents: https://www.matthewswong.com/llms.txt
- Sitemap: https://www.matthewswong.com/sitemap.xml
- API description (OpenAPI): https://www.matthewswong.com/openapi.json