NextAuth v4 vs Clerk: Your Tutorial Expired in 2022

Auth advice expired and nobody told you

Search "nextjs auth 2026" and get 2022 answers. v4 patterns that v5 moved. Clerk pitches priced for teams. Supabase guides that assume Supabase everything.

Your real decision has four live options. Different costs, different lock-ins, different migration cliffs.

Pick wrong and you get one of two outcomes. A migration that logs everyone out. Or per-user bills that scale against your freemium funnel.

Here is one honest table, weighted for a solo founder. Not vendor docs.

The four paths side by side

Three details outweigh feature lists.

Per-user auth pricing taxes freemium funnels. Past the free tier, thousands of retained users at per-user prices means auth costs margin before revenue exists. Self-hosted rows cost fractions of a cent.

The v4 to v5 migration is a real project. Callback paths shift. Patterns rename. Upgrades break silently. New builds start on v5. Old v4 apps migrate on purpose, never by accident.

Database chains are the deepest lock-in. Supabase Auth works beautifully inside Supabase and nowhere else. If your database choice ever changes, auth migrates with it or strands sessions.

What to do

Score your situation, not the hype. Five minutes. Honest answers.

• Freemium with a thousand or more free users? Self-hosted. Per-user math can hurt hosted.
• Committed to Supabase for everything? Supabase Auth is coherent.
• A team buying velocity this quarter? Clerk rents speed fairly.
• Solo, your own database, passwordless? v5 self-hosted. That is what BoringPush runs.

Revisit yearly, or when headcount, database or funnel shape changes.

Isolate auth behind one session field.

Only one piece of identity crosses into the app: the user's ID. Everything else reads that and looks up the user's row to decide access.

Vendor specifics live below that line. App logic lives above it. A future migration touches one place, not fifty.

The seam is the whole strategy.

Narrow.

Documented.

Boring.

Rehearse the exit before you need it.

Once a year, on staging: export your user rows with ID, email and access flag.

Import them into the target.

Force a re-login cohort.

Confirm paid access carries over.

A migration measured in hours and proven, not feared.

Picks by founder shape

An exit you rehearsed is optionality that is real. An exit you only theorized is lock-in with extra steps.

Self-hosted rows export trivially, because they are yours. That is why the drill passes in an afternoon.

Know this first

Self-hosted means you track a moving target. Auth.js changes. Upgrades need care.

Hosted options absorb that churn for money.

Why BoringPush is the way to do this

Own your auth. Keep your exits.

BoringPush runs NextAuth v5 with signed sessions and users in your database. Only the user's ID crosses into the app.

Change vendors later. Your users come with you.

FAQ

Is nextauth v4 vs clerk even the right framing in 2026?

It is the search people type, so it is the door they enter — but the real decision is v5-self-hosted vs Clerk vs Supabase-bundled, with v4 as the "stay put" option. This post answers the typed question then reframes to the live one. Meet the query, then correct it gently: v4 is history, the choice is among the other three.

How painful is the v4 to v5 migration really?

An afternoon to a week depending on customization depth: callback paths, middleware patterns, and adapter shapes all shift, and each custom credential provider needs individual attention. The 14-to-16 upgrade post covers the sibling pain. Migrate on a quiet week with the drill matrix green — never the week before launch, never by Dependabot accident.

What does Clerk do better than self-hosted, honestly?

Onboarding velocity (drop-in components in an afternoon), hosted UI polish (their designers beat your midnight CSS), and absorbed churn (upgrades, breaches, edge cases handled). Teams buying speed at headcount scale get fair value. Solos pay the per-user fee for polish they could ship once — different math, honest product, wrong customer.

Can I mix — Clerk for login, own DB for users?

You can (webhook-sync Clerk users into your rows), but you inherit both systems' failure modes and neither's simplicity: sync lag, dual source-of-truth arguments, export day still looms. Mixed auth is a migration state, not an architecture — pass through it deliberately during switches, never settle in it. One truth or two headaches.

Does Supabase Auth lock-in matter if I love Supabase?

Not until it does — coherent bundles are genuinely productive, and committed Supabase apps should use the bundled auth without guilt. The lock-in matters exactly when the database decision changes (scale, cost, geography), at which point auth migrates too or strands sessions.

Love the bundle; rehearse the exit anyway. Exits are for futures, not feelings.

When should auth choice be revisited?

Yearly, or when headcount crosses ~5 (velocity beats thrift), funnel crosses 10k free users (per-user math bites), or database strategy shifts (bundle coherence changes). Calendar it with pricing review — auth, billing, and pricing are one conversation about who pays for whom. Decisions expire; reviews compound.

Keep reading

• Next.js Auth in an Afternoon: Google + Magic Links — the v5 setup this post justifies
• redirect_uri_mismatch: The One-Character OAuth Fix — the first v5 error everyone meets
• Auth Without the 2 a.m. Pages: Google + Magic Links — the founding sketch behind the pick