Auth.js

Send Auth.js and NextAuth sign-in emails through Wakio.

npm install wakio

Auth.js 5 (next-auth 5)

// auth.ts
import NextAuth from "next-auth"
import Wakio from "wakio/authjs"

export const { handlers, auth, signIn, signOut } = NextAuth({
  adapter: yourDatabaseAdapter,
  providers: [Wakio({ from: "Acme <[email protected]>" })],
})

In CommonJS, the provider is require("wakio/authjs").default.

Set AUTH_WAKIO_KEY to your Wakio API key. Leave out from and the email goes from no-reply@ on one of your sending domains.

To send your own design, pass sendVerificationRequest and call the Wakio client yourself:

import Wakio from "wakio/authjs"
import { Wakio as Client } from "wakio"

async function sha256(value: string) {
  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value))
  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("")
}

Wakio({
  async sendVerificationRequest({ identifier, url, token, provider }) {
    const wakio = new Client({ apiKey: provider.apiKey })
    const result = await wakio.emails.send({ to: identifier, template: "sign-in", mergeData: { url } }, { idempotencyKey: `sign-in-${await sha256(`${identifier}\n${token}`)}` })
    if (result.suppressed.length) throw new Error("Wakio did not send the sign-in email")
  },
})

The client uses the AUTH_WAKIO_KEY that Auth.js hands the provider. The key hashes the address together with the token, as the built-in provider does, so two people who get the same short code never share a key. Hashing with Web Crypto keeps this file working in Edge middleware, which often imports auth.ts.

NextAuth 4

NextAuth 4 sends sign-in emails with Nodemailer, so give its email provider the Wakio transport:

// pages/api/auth/[...nextauth].ts
import NextAuth from "next-auth"
import EmailProvider from "next-auth/providers/email"
import { wakioTransport } from "wakio/nodemailer"

export default NextAuth({
  adapter: yourDatabaseAdapter,
  providers: [EmailProvider({ server: wakioTransport(), from: "Acme <[email protected]>" })],
})

Set WAKIO_API_KEY in your environment. NextAuth 4's email provider needs Nodemailer 7: npm install nodemailer@7 if it is not already there.

With the built-in provider and NextAuth 4, if the address is on your suppressed list, signing in fails with an error instead of telling the person to check an inbox that will never receive the link.