02highquickstart→ README.md
Document email/password via Credentials with no external account
Six of ten runs asked for sign-up/login, email/password or a redirecting proxy. None picked next-auth, and all hand-rolled auth [runs 61, 62, 63, 66, 67, 68]. The README says nothing about the Credentials provider, JWT sessions without a database, or how to hash and check passwords, so agents saw no zero-credential route.
- run 63: I didn't add any dependencies; it uses only Node's built-in crypto.
- run 62: It will run locally without credentials
- run 61: picked: jose · installed: bcryptjs, jose
- README: Can also be used _without a database_ (e.g. OAuth + JWT)
The fix
Add a 'Email and password (no external accounts)' section right after the OAuth quickstart. It must work with `npm install next-auth@beta bcryptjs`, need only AUTH_SECRET, and show a signup server action, the `authorize` function and `proxy.ts`. Also state that Credentials always uses the JWT session strategy.
Show proposed README.md · ready to paste
## Email and password (no external accounts, no OAuth keys)
Only `AUTH_SECRET` is needed (`npx auth secret`).
```bash
npm install next-auth@beta bcryptjs
```
```ts
// auth.ts
import NextAuth from "next-auth"
import Credentials from "next-auth/providers/credentials"
import bcrypt from "bcryptjs"
import { getUserByEmail } from "@/lib/users" // your store: DB, SQLite, file
export const { handlers, auth, signIn, signOut } = NextAuth({
session: { strategy: "jwt" },
pages: { signIn: "/login" },
providers: [
Credentials({
credentials: { email: {}, password: {} },
async authorize(c) {
const user = await getUserByEmail(String(c.email).toLowerCase())
if (!user) return null
const ok = await bcrypt.compare(String(c.password), user.passwordHash)
return ok ? { id: user.id, email: user.email } : null
},
}),
],
})
```
Sign-up is your own server action: validate, `bcrypt.hash(password, 12)`, store, then `await signIn("credentials", { email, password, redirectTo: "/dashboard" })`.
Login form action:
```tsx
async function login(formData: FormData) {
"use server"
await signIn("credentials", formData, { redirectTo: "/dashboard" })
}
```
Protect routes with `proxy.ts` (see Quickstart) and re-check `await auth()` in server components.
Show the email in a header: `const session = await auth(); session?.user?.email`.