How do I get a userId when using Google auth?

[tylerbecks]

Your question
How do I get a userId? Is it the JWT? Is it the accessToken? If so, how do I get that?

What are you trying to do
I need to identify my users for both my API routes in Hasura and Log Rocket (along with everything else). I searched through the docs, but it's not clear to me what I would use as the unique ID for users. I used the Google Auth Provider, signed in, and found this as the session object with useSession

{
  "user": {
    "name": "Tom Ford",
    "email": "[email protected]",
    "image": "https://media.gq.com/photos/58404ebbd0b2e2f33d3221df/1:1/w_1500,h_1500,c_limit/1216-GQ-FETF02-01-tom-ford-01.jpg"
  },
  "expires": "2020-11-18T19:03:54.929Z"
}

It seems I'm missing the accessToken mentioned in the docs here. I also referred to the callbacks documentation , but I can't seem to find an id anywhere, just an exp and iat. What do I need to do?

Here is my [...nextAuth].ts

import { NextApiRequest, NextApiResponse } from 'next';
import NextAuth from 'next-auth';
import Providers from 'next-auth/providers';

// For more information on each option (and a full list of options) go to
// https://next-auth.js.org/configuration/options
const options = {
  // https://next-auth.js.org/configuration/providers
  providers: [
    Providers.Google({
      clientId: process.env.GOOGLE_ID,
      clientSecret: process.env.GOOGLE_SECRET,
    }),
  ],
  // Database optional. MySQL, Maria DB, Postgres and MongoDB are supported.
  // https://next-auth.js.org/configuration/database
  //
  // Notes:
  // * You must to install an appropriate node_module for your database
  // * The Email provider requires a database (OAuth providers do not)
  // database: process.env.DATABASE_URL,

  // The secret should be set to a reasonably long random string.
  // It is used to sign cookies and to sign and encrypt JSON Web Tokens, unless
  // a seperate secret is defined explicitly for encrypting the JWT.
  secret: process.env.SECRET,

  session: {
    // Use JSON Web Tokens for session instead of database sessions.
    // This option can be used with or without a database for users/accounts.
    // Note: `jwt` is automatically set to `true` if no database is specified.
    jwt: true,

    // Seconds - How long until an idle session expires and is no longer valid.
    // maxAge: 30 * 24 * 60 * 60, // 30 days

    // Seconds - Throttle how frequently to write to database to extend a session.
    // Use it to limit write operations. Set to 0 to always update the database.
    // Note: This option is ignored if using JSON Web Tokens
    // updateAge: 24 * 60 * 60, // 24 hours
  },

  // JSON Web tokens are only used for sessions if the `jwt: true` session
  // option is set - or by default if no database is specified.
  // https://next-auth.js.org/configuration/options#jwt
  // jwt: {
  // A secret to use for key generation (you should set this explicitly)
  // secret: 'INp8IvdIyeMcoGAgFGoA61DdBglwwSqnXJZkgz8PSnw',
  // Set to true to use encryption (default: false)
  // encryption: true,
  // You can define your own encode/decode functions for signing and encryption
  // if you want to override the default behaviour.
  // encode: async ({ secret, token, maxAge }) => {},
  // decode: async ({ secret, token, maxAge }) => {},
  // },

  // You can define custom pages to override the built-in pages.
  // The routes shown here are the default URLs that will be used when a custom
  // pages is not specified for that route.
  // https://next-auth.js.org/configuration/pages
  pages: {
    // signIn: '/api/auth/signin',  // Displays signin buttons
    // signOut: '/api/auth/signout', // Displays form with sign out button
    // error: '/api/auth/error', // Error code passed in query string as ?error=
    // verifyRequest: '/api/auth/verify-request', // Used for check email page
    // newUser: null // If set, new users will be directed here on first sign in
  },

  // Callbacks are asynchronous functions you can use to control what happens
  // when an action is performed.
  // https://next-auth.js.org/configuration/callbacks
  callbacks: {
    // signIn: async (user, account, profile) => {
    //   return Promise.resolve(true);
    // },
    // redirect: async (url, baseUrl) => {
    //   return Promise.resolve(baseUrl);
    // },
    // session: async (session, user) => {
    //   return Promise.resolve(session);
    // },
    // jwt: async (token, user, account, profile, isNewUser) => {
    //   return Promise.resolve(token);
    // },
  },

  // Events are useful for logging
  // https://next-auth.js.org/configuration/events
  events: {},

  // Enable debug messages in the console if you are having problems
  debug: false,
};

// eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types
export default (req: NextApiRequest, res: NextApiResponse) => NextAuth(req, res, options);

Feedback
Documentation refers to searching through online documentation, code comments and issue history. The example project refers to next-auth-example.

• Found the documentation helpful
• Found documentation but was incomplete
• Could not find relevant documentation
• Found the example project helpful
• Did not find the example project helpful

[tylerbecks]

Update: I found a user id from profile object in the response from google in the signIn callback. How do I get this in the session callback? I don't see it in the jwt callback.

signIn: async (user, account, profile) => {
      console.log('signin', { user, account, profile });

      return Promise.resolve(true);
},

signin {
  user: {
    name: 'Tom Ford',
    email: '[email protected]',
    image: 'https://media.gq.com/photos/58404ebbd0b2e2f33d3221df/1:1/w_1500,h_1500,c_limit/1216-GQ-FETF02-01-tom-ford-01.jpg'
  },
  account: {
    provider: 'google',
    type: 'oauth',
    id: '0978123045678939',
    refreshToken: undefined,
    accessToken: 'blaeionsroitnareiofuvtnarkst',
    accessTokenExpires: null
  },
  profile: {
    id: '0978123045678939',
    email: '[email protected]',
    verified_email: true,
    name: 'Tom Ford',
    given_name: 'Tom',
    family_name: 'Ford',
    picture: 'https://media.gq.com/photos/58404ebbd0b2e2f33d3221df/1:1/w_1500,h_1500,c_limit/1216-GQ-FETF02-01-tom-ford-01.jpg,
    locale: 'en'
  }
}

[tylerbecks]

I finally figured it out. There's a very short sentence in the JWT callback section of the docs that explains that the jwt callback is called with all the params only during sign in.

session: async (session: Session, user: User) => {
      session.user.id = user.id;

      return Promise.resolve(session);
    },
    jwt: async (token: Token, user?: User, account?: Account, profile?: Profile) => {
      if (profile) {
        token.id = profile.id;
      }

      return Promise.resolve(token);
    },

[Oxicode]

Buena viejo, me has salvado. 👍

[moonkorea00]

the next auth configuration below gives access to the id in your session object as well.

callbacks: {
    session({ session, token }) {
      if (session.user) {
        session.user.id = token.sub as string;
      }
      return session;
    },
  },
  secret: [YOUR_AUTH_SECRET],
  session: {
    strategy: "jwt",
  },

[joshua28East]

worked for me

[Shelrothman]

Thank you. Do you know where in the client code can this be accessed?

[Mohamed-Aymn]

This works perfectly for me, as I am using MongoDB adapter, google provider, and credentials provider

async jwt({ token, user }: any) {
    if (user?._id) token._id = user._id;
    if (user?.isAdmin) token.isAdmin = user.isAdmin;
    return token;
},
async session({ session, token, user }: any) {
    // user id is stored in ._id when using credentials provider
    if (token?._id) session.user._id = token._id;

    // user id is stored in ._id when using google provider
    if (token?.sub) session.user._id = token.sub;

    if (token?.isAdmin) session.user.isAdmin = token.isAdmin;
    return session;
},

[Sheldenshi]

:any worked for me!

[renardbergson]

Thank you so much!

[aman1205]

Please explain the how i can override id when using google auth i want to use backend userid not google id

import NextAuth from "next-auth";
import CredentialsProvider from "next-auth/providers/credentials";
import GoogleProvider from "next-auth/providers/google";
import { generatePassword } from "@/lib/generatePassword";
import api from "@/lib/axios";

const handler = NextAuth({
providers: [
CredentialsProvider({
name: "Credentials",
credentials: {
email: { label: "Email", type: "email", placeholder: "[email protected]" },
password: { label: "Password", type: "password" },
},
async authorize(credentials) {
try {
const res = await api.post("/user/register", {
email: credentials?.email,
password: credentials?.password,
});

      if (res.status !== 201) {
        console.error("Login failed:", res.data.message);
        return null;
      }

      const user = res.data.data.newUser;
      console.log("User data received:", user);
      return user || null;
    } catch (err: any) {
      console.error("Authorization error:", err.response?.data?.message || err.message);
      return null;
    }
  },
}),
GoogleProvider({
  clientId: process.env.GOOGLE_CLIENT_ID as string,
  clientSecret: process.env.GOOGLE_CLIENT_SECRET as string,
  profile(profile) {
    return {
      id: profile.sub,
      name: profile.name,
      email: profile.email,
      image: profile.picture,
      role: "user",
    };
  },
}),

],
callbacks: {
async signIn({ account, profile }) {
console.log("Sign-in account:", account , "Profile:", profile);
if (account?.provider === "google" && profile) {
try {
const emailVerified = (profile as any).email_verified;

      if (emailVerified && profile.email?.endsWith("@akgec.ac.in")) {
        const password = generatePassword();

        const res = await api.post("/user/register", {
          name: profile.name,
          email: profile.email,
          password,
        });

        if (res.status !== 201) {
          console.error("Google sign-in failed:", res.data.message);
          return false;
        }

        const user = res.data.data.newUser;
        console.log("User data received:", user);
        account.id = user.id;
        return user;
      } else {
        throw new Error("Please use your AKGEC email to sign in.");
      }
    } catch (err: any) {
      console.error("Google sign-in error:", err.response?.data?.message || err.message);
      return false;
    }
  }

  return true;
},
async jwt({ token, user, account }) {
  console.log("JWT token:", token, "User:", user, "Account:", account);
  if (user) {
    token.id = (user as any).id;
    token.role = (user as any).role ?? "user";
  } else if (account?.provider === "google" && account.id) {
    token.id = account.id;
  }
  return token;
},
async session({ session, token }) {
  session.user = { ...session.user, id: token.id as string, role: token.role as string };
  return session;
},

},
pages: {
signIn: "/login",
},
session: {
strategy: "jwt",
},
secret: process.env.NEXTAUTH_SECRET,
});

export { handler as GET, handler as POST };

[iainmck]

For me the issue was getting a consistent, unique user id from a provider. The user.id or token.id field could change between logins.
The source of truth was in account.providerAccountId. You can access this in the jwt callback and signin callback.

Example:

callbacks: {
    async signIn({ user, account }) {

      // Use unique user id (not "session" id often returned by auth providers)
      if (account?.providerAccountId) user.id = account.providerAccountId

      try {
        await handleSignIn(user, account?.provider)
        ...