Add attributes to user during authorization

[danjamesmedia]

Whenever I try to add more attributes to the user object in a custom authorization call, it seems I can only set the name, email and image. I would like to add an Id field based on a value retrieved in the call made to my external API during the call.

I see the other way to set this is using the session callback, but this would involve an additional API call to get the info.

Is there any way that more attributes can be added to the user object/session during the authorization process?

[dimbslmh]

I was having the same issue, but it has been documented here https://next-auth.js.org/configuration/callbacks#session-callback:

When using JSON Web Tokens for sessions, the JWT payload is provided instead.

Tip

When using JSON Web Tokens the jwt() callback is invoked before the session() callback, so anything you add to the JSON Web Token will be immediately available in the session callback.

Tip

To better represent its value, when using a JWT session, the second parameter should be called token (This is the same thing you return from the jwt() callback). ...

In the jwt callback you can add attributes from the user object to the token object that you want to have during the session callback as the second parameter.

[jackzbazuka]

What if I'm using just a simple reddit sign in? I can only access the name, image and email. I want add the user's reddit id to my session.user, so I can access it on client side with session.user.uid

[balazsorban44]

Then I recommend reading the docs:

https://next-auth.js.org/configuration/callbacks#jwt-callback

https://next-auth.js.org/configuration/callbacks#session-callback

[raulmarindev]

Would it make sense to add a more specific example to the Callbacks section in the docs? I'm thinking of an example that shows all the changes needed in order to have custom attributes in a user. The reason being it's a very common scenario and users would benefit from it. Something similar to what was provided by @MateuszWawrzynski in his answer could be enough.

[ogooluwanick]

this is awesome, thanks .Although I'm not sure I fully understand the docs, I just added the missing field I needed to the jwt and session callback and I still returned the field in CredentialsProvider{authorize}

[derekgygax]

Yes, I more specific example would be extremely helpful in the docs.

[MateuszWawrzynski]

I had the same problem, but resolved it.
That thread helped me so much.
Thanks for answer @dimbslmh 👍

Explanation here:
https://stackoverflow.com/a/64595973/14536846

[baptisteArno]

NextAuth.js does not limit how much data you can store in a JSON Web Token, however a ~4096 byte limit per cookie is commonly imposed by browsers.

This? 👆

[balazsorban44]

https://next-auth.js.org/configuration/callbacks#session-callback

By default, only a subset of the token is returned for increased security. If you want to make something available you added to the token through the jwt() callback, you have to explicitly forward it here to make it available to the client.

[nemanjam]

I had to do this so that I have falsy session for non-logged in user.

async session({ session, token }) {
  const _session = token.user ? { ...session, user: token.user } : undefined; // set undefined explicitly 
  return _session as Session;
},

[balazsorban44]

If a user is not logged in, there is no session, so that would be unnecessary.

[phongvuhyuet]

I have another issue, because my user object is quite big so the token will be very heavy. I'd prefer not passing the user object to the token, is there any way else?

[nolawnchairs]

This is way more difficult than it needs to be.

[fFernandoh]

I find it a bit confusing what is what in nextAuth, but what I did and it worked was:

declare module "next-auth" {
  interface Session extends DefaultSession {
    user: {
      id: string;
      role: UserRole;
      emailVerified: Date;
      client: Client & {
        favorites: FictitiousProfileFavorite[];
      };
      yourData: YourType;
    } & DefaultSession["user"];
  }
}

in the CredentialsProviders:

 async authorize(data) {
        const email: string = data.email as string;

        const user = await db.user.findUnique({
          where: { email: email },
          include: {
            client: {
              include: {
                favorites: true,
              },
            },
          },
        });
        return user;