How to add authentication to Next.js without creating an account WorkOS released a CLI command, `npx workos@latest install`, that adds AuthKit sign-in, sign-out and session handling to a Next.js 15.3-or-later app without requiring a WorkOS account. The installer provisions an unclaimed AuthKit environment with its own client ID, API key and hosted domain, writes the credentials plus a generated cookie password to `.env.local`, and installs `@workos-inc/authkit-nextjs`; unclaimed environments expire after 7 days unless claimed into an account with a follow-up command. WorkOS positions the flow for coding agents, which can write the integration but cannot sign up for an account or click through a dashboard. How to add authentication to Next.js without creating an account Run one command to add sign-in to a Next.js app. The WorkOS CLI creates a temporary environment and writes your keys. Claim it when you want to keep it. To add authentication to a Next.js app without creating an account, run npx workos@latest install in your project. The WorkOS CLI provisions an unclaimed AuthKit environment, writes its credentials to .env.local , and adds sign-in, sign-out, and session handling to your code. When you want to keep the environment, you claim it into a WorkOS account with one more command. This tutorial walks through it in five steps: run the installer, review the changes, sign in, claim the environment, and finish setup. It also covers how coding agents can run the whole flow without a human signing up first. Why does adding auth usually start with an account? Until now, setting up AuthKit meant five steps in a browser: create an account, set up an environment, copy an API key and client ID, set a redirect URI, and generate a cookie password. Each step is a place to drop off when you're only trying something out. For a coding agent it's a hard stop. An agent can write the integration, but it can't sign up for an account or click through a dashboard, so it stalls at the first missing key and hands the task back to you. Accountless setup moves the account to the end. You get a working integration first and decide whether to keep it after. What is an unclaimed environment? An unclaimed environment is a WorkOS environment that the CLI creates without an account. It has its own client ID, API key, and hosted AuthKit domain, so sign-in works the same way it would in any other environment. It just isn't attached to anyone's WorkOS account yet. Unclaimed environments are for building and trying things out. They expire after 7 days unless you claim them. What do you need before you start? - A Next.js app on version 15.3 or later. No app yet? Create one with npx create-next-app@latest , which also sets up Git with a first commit. - A clean Git working tree. The installer checks for uncommitted changes and offers to put its edits on a new branch, so commit or stash your work first. - No WorkOS account and no API keys. Step 1: Run the installer From the root of your Next.js app, run: Behind the scenes, the installer: 1. Checks for existing keys. If any env file in the project already has a WORKOS API KEY , it keeps that key and doesn't create a new environment. 2. Provisions an unclaimed environment. With no keys found, it asks WorkOS for a new environment and gets back a client ID, an API key, an AuthKit domain, and a claim token. 3. Integrates AuthKit. It detects your Next.js version and router, installs @workos-inc/authkit-nextjs , and makes the code changes. It reads the current SDK docs as it works, so the code matches the SDK version it installs. If WorkOS can't provision an environment, the installer falls back to the usual login flow, so you're never stuck. Step 2: Review what changed The installer never stages, commits, or pushes anything. Review its branch like any other change. You'll find four kinds of changes. Environment variables in .env.local . The credentials for your unclaimed environment, plus a generated cookie password for encrypting sessions: A callback route. This is where AuthKit sends users after they sign in: Session handling. authkitProxy in proxy.ts on Next.js 16 and later, or authkitMiddleware in middleware.ts on Next.js 15: Auth in your UI.