What the secret is for
Auth.js, formerly NextAuth.js, uses its secret to encrypt session tokens and to sign cookies and verification tokens. In production it throws an error if the secret is missing. Version 5 reads AUTH_SECRET, while version 4 uses NEXTAUTH_SECRET.
The official command, npx auth secret, writes 32 random bytes as Base64. This generator produces the same format in your browser.
Setting it
AUTH_SECRET="paste-the-value-here"Add it to .env.local for development and to your hosting provider’s environment variables for production, with a different value in each.
Frequently asked questions
Do I need both AUTH_SECRET and NEXTAUTH_SECRET?
No. Use AUTH_SECRET with Auth.js v5 and NEXTAUTH_SECRET with NextAuth.js v4.
What happens if I change it?
Existing sessions can no longer be decrypted, so users have to sign in again.