Payload CMS is a headless content management system framework built on Next.js and TypeScript. It functions as a full-stack application generator, allowing developers to define content schemas (collections, globals) which automatically produce an admin UI, REST/GraphQL APIs, and database schemas. The architecture is a monorepo utilizing pnpm workspaces, with distinct packages for core logic (packages/payload), the admin interface (packages/ui), and database/storage adapters (packages/drizzle, packages/db-mongodb, packages/storage-*). It heavily leverages Next.js App Router and React Server Components for data fetching and rendering. The system supports polyglot persistence through adapters for PostgreSQL (via Drizzle ORM), MongoDB (via Mongoose), SQLite, and Cloudflare D1. It also abstracts file storage across providers like S3, Azure, GCS, and Vercel Blob. A significant portion of the codebase involves complex integration with the Lexical rich text editor and a robust plugin ecosystem for features like SEO, Ecommerce, and Multi-tenancy. The framework emphasizes developer experience through CLI tools, codemods for version upgrades, and extensive type generation. Maintenance is active with frequent commits and a large test suite covering integration and E2E scenarios. However, the complexity of maintaining multiple database and storage adapters alongside rapid Next.js ecosystem changes introduces a medium level of technical drift risk. Generated files in the admin UI and API routes require careful handling to avoid conflicts during framework updates, and the sheer number of open issues (846) suggests ongoing technical debt management.
This repository is a Payload CMS authentication plugin (payload-auth-plugin) that provides OAuth2, OIDC, password, and passkey authentication strategies. It is designed to be used with Payload CMS v3+ and integrates deeply with Payload's admin panel and frontend via custom API endpoints, collection field injection, and a client-side library. The plugin supports multiple providers (Google, GitHub, Apple, etc.) via a clean provider factory pattern and manages its own session cookies, credential hashing (PBKDF2), and account linking. The architecture is a plugin that hooks into Payload's lifecycle, extending the CMS with authentication endpoints and database collections. The example application (examples/with-website/) demonstrates a full Payload CMS + Next.js website with admin and public authentication flows. Despite being pre-1.0, the codebase exhibits solid engineering patterns: strategy pattern for endpoint registration, collection helper functions that merge user-defined configs, and a reusable AuthClient class for browser-side authentication. However, it lacks automated tests, has several FIXME comments in passkey and password protocols, and is tightly coupled to Payload's internal DB and cookie mechanisms, which introduces technical drift risk as Payload evolves. The plugin is actively maintained with frequent releases and a changelog documenting 50+ versions.