@aardani I remember you helped me with something similar a while ago, maybe you know the answer
(sorry for mention)

you can use callbackUrl
https://github.com/nextauthjs/next-auth/issues/7645#issuecomment-1563814286
and then on that route that you specified you perform your checks and redirect whenever you need.

I can't do this, I need to modify the user default session data and include the id (if the account exists), and I can only do this within jwt()

☝️

but your jwt callback still runs, you just additionaly redirect user from custom route that will handle redirect only

anyway, i need the tokenJwt generated in jwt() with the data returned from oauth2, to redirect it to the account creation page

in your custom route you'll just again get data from database, and you can prehydrate it, but actually probably till that moment your jwt already will be changed.

I thought about saving this tokenJwt along with the other data, something like token.validationToken = tokenJwt. In the session callback, I could include this validationToken in the session data and access it in signup page, what do you think?

didn't get that, if you can access validationToken field then you already have your token decoded, why do you need then to store it inside itself.
as I said probably you can just access token itself and get data from there, but if not you'll just need to make either server-side prehydration to get user data from db, either client side another ajax request to get userid.

I have access to the validationToken within jwt() when the user authorizes, but I need to access this token with their account info within a component
If he authorizes oauth2 and my external api doesn't find his account in the database, I need to redirect him to an account confirmation page, on this page I need to show the name, avatar and email (this information is in tokenJwt )

so I thought the only alternative would be to save this token with the user information somewhere to access it on the front-end (on the page where the information needs to be displayed)

not sure but probably it'll be better for you to add your data to jwt, and then in session callback like in docs example https://next-auth.js.org/configuration/callbacks#session-callback add this data to session , and later in client side you can retrieve this data directly from session.

i thought about this possibility, that's what i meant here

i will try that, ty

taking advantage of this post, i'm using next-auth in a project along with an external API
in this API, there are some routes that require the user to be logged in to function, i thought about using the new server actions from next.js to check if the user is logged in before sending the request (within the function itself)
in my mind, this way, i wouldn't have to send authorization headers, validate it in the API, etc. It would be much simpler... and it would also prevent DDoS attacks since the route of my API wouldn't be exposed to the front end, is that correct? would there be any security flaws in this?