I went for NextAuth - the use case was relatively simple, and I wanted maximum control.