nextauthjs/next-auth · error · MissingAdapter

WebAuthn provider requires a database adapter to be configur

Error message

WebAuthn provider requires a database adapter to be configured

What it means

Auth.js's WebAuthn (passkey) provider stores and looks up authenticator credentials in the database, so it hard-requires a database adapter. getUserInfo throws MissingAdapter as soon as it sees options.adapter is undefined — i.e. the AuthConfig was set up without an adapter (or without Prisma/Drizzle/Mongoose etc. support) while including the WebAuthn provider.

Source

Thrown at packages/core/src/providers/webauthn.ts:243

  }
}

/**
 * Retrieves user information for the WebAuthn provider.
 *
 * It looks for the "email" query parameter and uses it to look up the user in the database.
 * It also accepts a "name" query parameter to set the user's display name.
 *
 * @param options - The internaloptions object.
 * @param request - The request object containing the query parameters.
 * @returns The existing or new user info.
 * @throws {MissingAdapter} If the adapter is missing.
 * @throws {EmailSignInError} If the email address is not provided.
 */
const getUserInfo: GetUserInfo = async (options, request) => {
  const { adapter } = options
  if (!adapter)
    throw new MissingAdapter(
      "WebAuthn provider requires a database adapter to be configured"
    )

  // Get email address from the query.
  const { query, body, method } = request
  const email = (method === "POST" ? body?.email : query?.email) as unknown

  // If email is not provided, return null
  if (!email || typeof email !== "string") return null

  const existingUser = await adapter.getUserByEmail(email)
  if (existingUser) {
    return { user: existingUser, exists: true }
  }

  // If the user does not exist, return a new user info.
  return { user: { email }, exists: false }
}

View on GitHub (pinned to a1a16a5a77)

Solutions

Configure a database adapter in your AuthConfig (e.g. PrismaAdapter, DrizzleAdapter) via the adapter option.
Add the required WebAuthn models (Authenticator table) to your database schema and regenerate the client.
If you don't need passkeys, remove the WebAuthn provider from the providers array.
Ensure the exported auth config used by route handlers actually includes the adapter (don't conditionally omit it).

Example fix

// before
export const { handlers, auth, signIn, signOut } = NextAuth({
  providers: [WebAuthn({ enableUI: true })],
})
// after
import { PrismaAdapter } from "@auth/prisma-adapter"
import { prisma } from "@/lib/prisma"
export const { handlers, auth, signIn, signOut } = NextAuth({
  adapter: PrismaAdapter(prisma),
  providers: [WebAuthn({ enableUI: true })],
})

Defensive patterns

Strategy: validation

Validate before calling

// Fail fast at startup if WebAuthn is configured without an adapter:
if (config.providers.some((p) => (p as { id?: string }).id === "webauthn") && !config.adapter) {
  throw new Error("WebAuthn provider requires an adapter")
}

Type guard

function hasWebAuthnWithoutAdapter(config: { providers: { id?: string }[]; adapter?: unknown }): boolean {
  return config.providers.some((p) => p.id === "webauthn") && !config.adapter
}

Try / catch

try {
  await signIn("webauthn")
} catch (err) {
  if ((err as Error).message.includes("database adapter")) {
    console.error("Configure an adapter (e.g. PrismaAdapter) to use passkeys")
  }
}

Prevention

Always pair the WebAuthn provider with an adapter in your auth config.
Add the Authenticator model to your schema before enabling passkeys.
Write a startup-time config test that asserts adapter presence when WebAuthn is enabled.
Remove the WebAuthn provider if your app is intentionally stateless.

When it happens

Trigger: Any WebAuthn flow (registration or authentication POST/GET to /auth/callback/webauthn or /auth/webauthn endpoints) when the auth config has providers: [WebAuthn(...)] but no adapter is configured — typically a stateless setup (e.g. JWT-only, no database) that added passkey support.

Common situations: Developers add the WebAuthn provider to an existing credentials/OAuth-only Auth.js setup that never had a database; or they deploy with adapter code commented out / conditional so it's undefined in production; or they import the wrong auth configuration in a route handler.

Related errors

AI-assisted analysis of nextauthjs/next-auth@a1a16a5a77 (2026-08-28). Data as JSON: /api/errors/0ae1f770593994b2. Report an issue: GitHub.