Next-Auth credentials not returning session and not storing Session and Account in db via prisma adapter

The CredentialsProvider is not compatible with Database Sessions. In order for credentials to work, you need to configure Next-Auth to use JWT sessions instead of Database sessions.

This can be done by setting the "session" option within Next-Auth

export default NextAuth({
   session: {
      strategy: "jwt",
      maxAge: 3000,
   }
   providers: []
   ...
})

As pointed out by @Mike the Credentials Provider is restricted to using only JWT by the next-auth developers. However, you can implement a workaround to have it leverage the database sessions by doing the following:

1. Create a signup api route that ensures that all user accounts that use credentials are linked to an entry in the accounts table

2. Initialize NextAuth using advanced initialization

3. Register a signIn callback as a part of the NextAuth callback options that uses the database adapter provided to NextAuth to create a session using the createSession method.

    async signIn({ user, account, profile, email, credentials }) {
        // Check if this sign in callback is being called in the credentials authentication flow. If so, use the next-auth adapter to create a session entry in the database (SignIn is called after authorize so we can safely assume the user is valid and already authenticated).
        if (req.query.nextauth.includes('callback') && req.query.nextauth.includes('credentials') && req.method === 'POST') {
            if (user) {
                const sessionToken // Implement a function to generate the session token (you can use randomUUID as an example)
                const sessionExpiry // Implement a function to calculate the session cookie expiry date
   
                await adapter.createSession({
                    sessionToken: sessionToken,
                    userId: user.id,
                    expires: sessionExpiry
                })
   
                const cookies = new Cookies(req,res)
   
                cookies.set('next-auth.session-token', sessionToken, {
                    expires: sessionExpiry
                })
            }   
        }
   
        return true;
    }
   

4. In the NextAuth jwt options provide new functions for the encode and decode. These functions should check that the auth flow is in the callback and also that the provider is credentials. When using the credentials provider is should return as a String the sessionToken in the encode and always return null for decode. Outside the credentials is should do the normal JWT encode and decode behaviours.

   jwt: {
        // Customize the JWT encode and decode functions to overwrite the default behaviour of storing the JWT token in the session cookie when using credentials providers. Instead we will store the session token reference to the session in the database.
        encode: async (token, secret, maxAge) => {
            if (req.query.nextauth.includes('callback') && req.query.nextauth.includes('credentials') && req.method === 'POST') {
                const cookies = new Cookies(req,res)
   
                const cookie = cookies.get('next-auth.session-token')
   
                if(cookie) return cookie; else return '';
   
            }
            // Revert to default behaviour when not in the credentials provider callback flow
            return encode(token, secret, maxAge)
        },
        decode: async (token, secret) => {
            if (req.query.nextauth.includes('callback') && req.query.nextauth.includes('credentials') && req.method === 'POST') {
                return null
            }
   
            // Revert to default behaviour when not in the credentials provider callback flow
            return decode(token, secret)
        }
    },
   

Both functions above must be defined within the auth(req, res) handler for [...nextauth].js api route as they need to be in the same scope to have access to the raw http requests as well as the options provided by NextAuth.

Example code can be found under the responses for GitHub issue #4394 or for a more detailed explanation read this blog post I created.