NextAuth OAuth Integration#

Langfuse uses NextAuth.js for all authentication, configured in web/src/server/auth.ts. The central export is getAuthOptions(), which assembles static and dynamic SSO providers, a customized Prisma adapter, and NextAuth callbacks.

Sessions use the JWT strategy with a configurable max age 1.

Supported Providers#

Langfuse ships with the following built-in OAuth/OIDC providers, each activated by setting the corresponding environment variables 2:

Enterprise multi-tenant SSO providers are loaded dynamically at runtime via loadSsoProviders() 3.

Every provider accepts an AUTH_<PROVIDER>_ALLOW_ACCOUNT_LINKING flag (defaults false) that maps to NextAuth's allowDangerousEmailAccountLinking option, enabling linking of a new OAuth identity to an existing account with the same email 4.

Custom OIDC Provider#

The CustomSSOProvider in packages/shared/src/server/auth/customSsoProvider.ts is a generic OIDC wrapper for any standards-compliant IdP. It supports overriding the JWT claims used to extract user identity via 5:

• LANGFUSE_CUSTOM_SSO_EMAIL_CLAIM — defaults to email
• LANGFUSE_CUSTOM_SSO_NAME_CLAIM — defaults to name
• LANGFUSE_CUSTOM_SSO_SUB_CLAIM — defaults to sub

This is critical for IdPs like Azure AD that may return email in preferred_username or upn instead of email 6.

Custom PrismaAdapter Extensions#

Langfuse wraps the standard PrismaAdapter with extendedPrismaAdapter 7, overriding three methods:

createUser#

Enforces signup guards before delegating to the base adapter 8:

• Throws if AUTH_DISABLE_SIGNUP=true or NEXT_PUBLIC_SIGN_UP_DISABLED=true
• Throws if the profile lacks an email address
• After creation, calls createProjectMembershipsOnSignup to assign default org/project memberships

linkAccount#

Sanitizes provider-specific fields that are incompatible with the Prisma schema before persisting the OAuth account record 9:

• Keycloak: removes refresh_expires_in and not-before-policy — known incompatibilities tracked in nextauthjs/next-auth#7655 10
• WorkOS: removes the profile field 11
• Any provider: fields listed in AUTH_IGNORE_ACCOUNT_FIELDS (comma-separated) are deleted before the upsert 12

After linking, createProjectMembershipsOnSignup is called again for the linked user — this handles existing users who log in via SSO for the first time and should receive default memberships 13.

useVerificationToken#

Adds anti-enumeration protection for email OTP (used in the password-reset flow): on failure or error, all tokens for that identifier are purged and the failure is logged 14.

Signup Control#

Common pitfall: Setting AUTH_DISABLE_SIGNUP=true blocks new users from signing up via SSO too, not just email/password. New SSO users get OAuthCreateAccount errors. Use AUTH_DISABLE_USERNAME_PASSWORD=true to force SSO-only logins without blocking auto-provisioning 6.

signIn Callback#

The signIn callback runs on every authentication attempt:

1. Validates that user.email is present and well-formed.
2. Enforces enterprise multi-tenant SSO domain rules (redirects to error page if the user's email domain is locked to a different provider).
3. Restricts email-OTP (password reset) sign-in to users who already exist in the database.
4. Optionally restricts Google logins to specific hosted domains via AUTH_GOOGLE_ALLOWED_DOMAINS.

Key Files#