Authentication plugins for Payload CMS

Authentication plugins for Payload CMS: OAuth, SSO, MFA, RBAC, passkeys and better-auth integrations. Compare and install community solutions.

Authentication plugins add user identity to Payload CMS — from OAuth and SSO sign-in to multi-factor auth, passkeys and fine-grained RBAC/ABAC access control. They extend Payload's built-in auth rather than replacing it, so you keep the admin login while adding providers and policies.

What these plugins cover

OAuth / SSO providers and social login
MFA, TOTP and passkeys (WebAuthn)
Passwordless and magic-link sign-in
Role- and attribute-based access (RBAC/ABAC)
Session, JWT and API-key management
better-auth and Auth.js integrations

Choosing an auth approach

For a public app, start with social OAuth plus optional MFA; for internal tools, layer RBAC/ABAC on top of SSO. Pair access rules with admin tooling for audit logs.

auth plugin

Adds authentication capabilities to Payload CMS.

307 2.7k/wk v3 Auth

oAuth plugin

Integrates OAuth authentication into Payload CMS using passport-oauth2.

113 52/wk v2 Auth

RBAC permissions UI

Adds a permissions management UI for roles in Payload CMS.

1 v3 Auth

Masquerade

Masquerade user for Payload CMS.

30 206/wk v3 Auth

RBAC

Add role-based access control features to Payload CMS.

7 29/wk v3 Auth

Better Auth

Better Auth adapter and plugins for Payload CMS.

63 1.5k/wk v3 Auth

Passkey

Adds WebAuthn passkey login and management to Payload CMS accounts via Better Auth.

944/wk v3 Auth

payload-auth

Integrates Better Auth for enhanced authentication in Payload CMS.

326 7.7k/wk v3 Auth

Google One Tap

Adds Google One Tap sign-in to the Payload admin login page using OAuth credentials.

13 2/wk v1 Auth

Default Roles

Applies default role-based access control to every Payload collection, granting CRUD access to specified roles such as admin and executive.

9 1/wk v1 Auth

Warding

RBAC plugin that generates user and role collections and injects fine-grained access control across Payload collections, globals, fields, and endpoints.

17 2/wk v2 Auth

Simple RBAC

Enables role-based access control in Payload CMS.

41 6/wk v1 Auth

Magic Login

A Magic Login plugin for Payload CMS that simplifies user authentication.

3 1/wk v2 Auth

RBAC

Adds role-based access control to your Payload CMS.

140 39/wk v1 Auth

reCAPTCHA v3

This plugin protects Payload collection operations using Google reCAPTCHA v3.

35 66/wk v3 Auth

OIDC plugin

Integrate OpenID Connect authentication into Payload CMS.

35 32/wk v2 Auth

Gatekeeper

Adds role-based access control to Payload CMS v3 with wildcard permissions, auto-generated permissions per collection, and a managed Roles collection.

23 145/wk v3 Auth

Auth0 integration

Integrates Auth0 authentication with Payload CMS.

62 20/wk v2 Auth

Zitadel integration

Integrates Zitadel authentication into Payload CMS applications.

12 29/wk Auth

Subscribers

Manage subscribers and channels with magic link authentication.

2 v3 Auth

Frequently asked questions

Which auth methods do Payload plugins support?

Community plugins cover OAuth and SSO providers, multi-factor auth (TOTP, passkeys) and role- or attribute-based access control, plus better-auth and Auth.js adapters.

How do these integrate with Payload's built-in auth?

Most plugins extend the existing auth collection and access-control hooks — you keep Payload's admin login and add providers, strategies or policies on top, rather than replacing the auth system.

Are these authentication plugins free?

Every plugin listed on Payload Market is open-source and free to install; pricing only applies to optional hosted services some authors offer.