Customize AUTH_URL for multi-tenant server

[setoelkahfi]

I have a Linux server with multiple NextJS applications and am integrating OAuth from the likes of Google, Apple, Spotify, and GitHub. How do you set multiple AUTH_URL environment variables? I've read the documentation and couldn't find any information about it. I'm using v5-beta30.

[Jamonygr]

You don’t set “multiple AUTH_URL values” inside one running NextAuth/Next.js process. An environment variable has one value per process.

What you do depends on your setup:

Case A) Multiple Next.js apps = multiple Node processes (most common)

Run each app as its own service/process (different port or socket), and give each one its own env:

app1 process: AUTH_URL=https://app1.example.com

app2 process: AUTH_URL=https://app2.example.com

This is the normal way—separate .env files, separate systemd services, separate PM2 apps, separate Docker containers, etc.

Auth.js v5 also says AUTH_URL is “mostly unnecessary” because the host can be inferred, but it’s still valid to set per app—especially if you use a custom base path.
Auth.js
+1

Case B) One Next.js app serves multiple hostnames behind a reverse proxy

In v5, you usually don’t set AUTH_URL at all. You let Auth.js infer the host from request headers, and if you’re behind a proxy you set:

AUTH_TRUST_HOST=true

That tells Auth.js to trust X-Forwarded-Host / X-Forwarded-Proto from your reverse proxy for origin detection.
Auth.js
+1

Make sure your proxy forwards headers properly (nginx example):

proxy_set_header Host $host;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Proto $scheme;

Important: provider callback URLs still must match each app/domain

For Next.js, the default callback pattern is typically:
https://your-domain.com/api/auth/callback/[provider]
Auth.js

And many providers require you to register each callback URL (sometimes you need separate OAuth apps depending on the provider’s rules).
Auth.js

Quick rule

Multiple apps/processes: set one AUTH_URL per app process, via that app’s environment.

Multiple domains on one app: omit AUTH_URL, set AUTH_TRUST_HOST=true, and rely on forwarded headers.