Authentication & Access
Plugins for signing users in and deciding what each user may read or change in Payload.
37 plugins, ranked by health score, then weekly downloads.
multi tenant
Manage multiple tenants with scoped content and access from a single Payload admin panel
10090.4k/wk45.4kv3
payload better auth
Better Auth database adapter and plugins that replace Payload's local auth strategy
700/wk74v3
payload totp
Add TOTP-based two-factor authentication to a Payload auth collection using authenticator apps
670/wk163v3
payload passkey
Passkey login and management for the Payload admin, built on Better Auth
65219/wk1v3
payload simple social login
Google and Microsoft Entra ID social login for the Payload admin panel and auth collections
650/wk3v3
rbac
Database-stored roles with a per-collection CRUD permission matrix enforced across all collections and globals
6327/wk15v3
payload auth
Replaces Payload's built-in auth with Better Auth, sharing one session between the admin panel and your app
590/wk344v3
payload oauth2
Generic OAuth2 sign-in for Payload auth collections with any OAuth2 provider
570/wk198v3
plugin
OAuth 2.1 with PKCE and dynamic client registration for the Payload MCP plugin, enabling custom connectors
570/wk8v3
payload plugin rbac
Database-driven role-based access control with a permission matrix and data scoping for Payload
5627/wk10v3
payload authjs
Use Auth.js 5 providers to sign in and authenticate users in Payload CMS 3
560/wk207v3
payload auth pwless
Passwordless login for Payload with passkeys, magic links, OAuth and refresh-token sessions
550/wk2v3
payload plugin masquerade
Let admins switch to another user and browse as them without a password, then switch back
530/wk30v3
rbac
Database-driven role-based access control with a per-collection permissions matrix in the Payload admin
530/wk0v4
abac
Attribute-based access control that compiles user attributes into Payload where clauses
520/wk181v3
payload auth plugin
Authentication plugin adding OAuth, OpenID Connect, SSO and passkey sign-in to Payload CMS
500/wk310v3
payload keycloak
Keycloak SSO login for the Payload admin using OIDC with PKCE, silent refresh and permission-based access helpers
500/wk0v3
Payload RBAC Plugin
Database-backed role and permission management with row-level conditions for Payload collections
500/wk6v3
payload plugin oauth
OAuth sign-in for the Payload admin using passport-oauth2 with configurable providers
490/wk112v2
payload social auth
OAuth social login for the Payload admin with GitHub, Google, Facebook, Twitter and LinkedIn
480/wk3v3
payload subscribers plugin
Subscriber accounts with magic link or one-time code sign-in and opt-in channel management
450/wk3v3
rbac
Role-based access control with ready-made access functions and query filters for Payload auth collections
4418/wk142v1
payload tenancy
Multi-tenancy for Payload 2 with user, path or domain tenant isolation and hierarchical tenants
449/wk180v2
payload auth cookie
Authenticate Payload admin and frontend users from cookies set by an external SSO system
4019/wk3v3
payload gatekeeper
Role-based access control for Payload with wildcard permissions, auto role assignment and a managed Roles collection
39150/wk25v3
payload simple rbac
Priority-ordered role-based access control for Payload collections, globals and fields
380/wk41v1
payload warding
Collection and global backed role-based access control with per-field and per-endpoint permissions
375/wk17v2
payload plugin oidc
Sign in to the Payload admin with any OpenID Connect provider
350/wk36v2
payload better auth
Integrates the Better Auth library into Payload CMS 3 for social login, two-factor auth and role-based access
3474v3
payload auth workos
WorkOS OAuth and enterprise SSO sign-in for Payload admin and app user collections
330/wk5v3
payload plugin rbac ui
Permissions matrix UI for a Roles collection with auto-discovered permission strings
320/wk1v3
payload better auth
Replace Payload's built-in auth with Better Auth, including admin email OTP and req.user mapping
301v3
payload auth0 plugin
Auth0 sign-in for the Payload admin panel using a custom auth strategy
290/wk62v2
payload zitadel plugin
Sign in to the Payload admin through Zitadel using an OIDC login button and auth strategy
260/wk11v?
payload default roles
Apply default role-based access permissions to all Payload collections
200/wk9v1
payload magic login
Passwordless magic link login for Payload via emailed, JWT-signed links
200/wk3v2
payload plugin google one tap
Adds Google One Tap sign-in to the Payload admin login page
01/wk13v1