Using with Auth.js (NextAuth)
How to authenticate AI agents with Auth.js (NextAuth) — map agent tokens to existing user accounts and enable agent signups.
Auth.js (formerly NextAuth) manages cookie-based sessions for human users in Next.js applications. AgentOnboard provides the API token layer for AI agents calling your protected routes.
1. Verifying existing Auth.js users
In your App Router route handler, use requireAgentAccount and query your database adapter:
import { requireAgentAccount } from "@agentonboard/sdk/next";
import { prisma } from "@/lib/prisma"; // Or Drizzle, Prisma, MongoDB
export async function POST(request: Request) {
const session = await requireAgentAccount(request, {
audience: "notes.com",
resolveAccount: async ({ email }) => {
// Find the user associated with this verified email
const user = await prisma.user.findUnique({
where: { email: email.toLowerCase() },
});
return user?.id ?? null;
},
});
// Automatically returns 401 (expired/invalid) or 403 (ACCOUNT_REQUIRED)
if (!session.ok) return session.response;
// session.user is your database user ID
return Response.json({ success: true, user_id: session.user });
}2. Enabling agent signup with Auth.js
To allow agents to create accounts for strangers on your signup route, use createAgentAccount:
import { createAgentAccount } from "@agentonboard/sdk";
import { prisma } from "@/lib/prisma";
export async function POST(request: Request) {
const outcome = await createAgentAccount({
token: request.headers.get("Authorization") ?? "",
audience: "notes.com",
resolveAccount: async ({ email }) => {
const user = await prisma.user.findUnique({
where: { email: email.toLowerCase() },
});
return user?.id ?? null;
},
createAccount: async ({ email }) => {
// Create user record in your Auth.js database table
const newUser = await prisma.user.create({
data: {
email: email.toLowerCase(),
emailVerified: new Date(),
},
});
return newUser.id;
},
});
if (!outcome.ok) {
return Response.json(
{ code: outcome.code, error: outcome.error },
{ status: outcome.code === "RESOLVER_ERROR" ? 500 : 401 }
);
}
return Response.json(
{ user_id: outcome.user, created: outcome.created },
{ status: 201 }
);
}emailVerified: new Date()
Because the AgentOnboard token is backed by a verified human email inbox, you can mark emailVerified as verified immediately in your adapter.