Server-side (passwordless) CredentialsProvider login

[nbouvrette]

Description 📓

Currently, next-auth supports custom CredentialsProvider and allows logins/sign-up using usernames/passwords.

The challenge is that if you want a custom account creation flow, let's say one that takes multiple steps (e.g., email verification before account creation), the only way to do this with next-auth is to do this process separately and then log in to the account.

The challenge with this is that typically account passwords are hashed, which means we never store the original value. Because there is no way to log in using next-auth without the plaintext password, it can become very tricky for users to develop their own way to manage that process.

If next-auth could provide a server-side API (can be just a simple function that is called server-side only) that would allow to log in without a password, then custom user creation processes would not have to deal with the plain text password.

How to reproduce ☕️

See description.

Contributing 🙌🏽

No, I am afraid I cannot help regarding this