← All posts
·5 min read
#nextjs#auth#database

NextAuth / Auth.js Database Schema Explained

Every table NextAuth (Auth.js) creates in your database -- users, accounts, sessions, verification_tokens -- and how they connect.

The short version

NextAuth (Auth.js) creates 4 tables in your database: users, accounts, sessions, and verification_tokens. The users and accounts tables have a one-to-one relationship via accounts.user_id. Sessions link to users via sessions.user_id. Verification tokens are short-lived and self-cleaning.

The 4 tables

users

ColumnTypeWhat it means
idtext / UUIDPrimary key. Generated by NextAuth.
nametextDisplay name from the OAuth provider.
emailtextUser's email. May be null if the provider doesn't share it.
email_verifiedtimestampWhen the email was verified. Null if never verified.
imagetextProfile picture URL from the provider.
created_attimestampWhen the user first signed in.
updated_attimestampLast profile sync from the provider.

accounts

Links a user to an OAuth provider. One user can have multiple accounts (Google + GitHub).

ColumnTypeWhat it means
idtext / UUIDPrimary key.
user_idtextForeign key → users.id.
providertext"google", "github", "discord", etc.
provider_account_idtextThe provider's unique ID for this user.
access_tokentextOAuth access token (encrypted in production).
refresh_tokentextOAuth refresh token (encrypted in production).
expires_atintegerWhen the access token expires (Unix timestamp).

sessions

ColumnTypeWhat it means
idtext / UUIDPrimary key.
session_tokentextThe session token stored in the user's cookie.
user_idtextForeign key → users.id.
expirestimestampWhen this session expires.

verification_tokens

Short-lived tokens for email verification and password reset. Self-cleaning.

ColumnTypeWhat it means
identifiertextEmail or user ID the token is for.
tokentextThe actual token value.
expirestimestampWhen this token expires.

How they connect

users → accounts is one-to-one per provider. users → sessions is one-to-many (different devices). verification_tokens is temporary and doesn't have a foreign key.

FAQ

Does NextAuth store passwords?
No. NextAuth is OAuth-first. If you need email/password, use next-auth/providers/credentials with bcrypt.

Can I add custom fields to the users table?
Yes. Add columns directly. NextAuth ignores columns it doesn't know about.

What happens when a user deletes their account?
NextAuth doesn't cascade deletes. Manually delete from users, accounts, and sessions.

Visualize your own database

Paste your PostgreSQL connection string and get an interactive ER diagram in under 10 seconds. No signup required.