diff --git a/src/client/_utils.ts b/src/client/_utils.ts
index f11411da9e..5b29d843d3 100644
--- a/src/client/_utils.ts
+++ b/src/client/_utils.ts
@@ -45,7 +45,7 @@ export async function fetchData<T = any>(
     return Object.keys(data).length > 0 ? data : null // Return null if data empty
   } catch (error) {
     logger.error("CLIENT_FETCH_ERROR", {
-      error,
+      error: error as Error,
       path,
       ...(req ? { header: req.headers } : {}),
     })
@@ -84,9 +84,9 @@ export function BroadcastChannel(name = "nextauth.message") {
   return {
     /** Get notified by other tabs/windows. */
     receive(onReceive: (message: BroadcastMessage) => void) {
-      const handler = (event) => {
+      const handler = (event: StorageEvent) => {
         if (event.key !== name) return
-        const message: BroadcastMessage = JSON.parse(event.newValue)
+        const message: BroadcastMessage = JSON.parse(event.newValue ?? "{}")
         if (message?.event !== "session" || !message?.data) return
 
         onReceive(message)
@@ -95,7 +95,7 @@ export function BroadcastChannel(name = "nextauth.message") {
       return () => window.removeEventListener("storage", handler)
     },
     /** Notify other tabs/windows. */
-    post(message) {
+    post(message: Record<string, unknown>) {
       if (typeof window === "undefined") return
       localStorage.setItem(
         name,
diff --git a/src/core/errors.ts b/src/core/errors.ts
index c75e94a5f1..93ab69b73c 100644
--- a/src/core/errors.ts
+++ b/src/core/errors.ts
@@ -6,9 +6,9 @@ import type { Adapter } from "../adapters"
  * @source https://iaincollins.medium.com/error-handling-in-javascript-a6172ccdf9af
  */
 export class UnknownError extends Error {
-  constructor(error) {
+  constructor(error: Error | string) {
     // Support passing error or string
-    super(error?.message ?? error)
+    super((error as Error)?.message ?? error)
     this.name = "UnknownError"
     if (error instanceof Error) {
       this.stack = error.stack
@@ -56,10 +56,10 @@ export function eventsErrorHandler(
   return Object.keys(methods).reduce<any>((acc, name) => {
     acc[name] = async (...args: any[]) => {
       try {
-        const method: Method = methods[name]
+        const method: Method = methods[name as keyof Method]
         return await method(...args)
       } catch (e) {
-        logger.error(`${upperSnake(name)}_EVENT_ERROR`, e)
+        logger.error(`${upperSnake(name)}_EVENT_ERROR`, e as Error)
       }
     }
     return acc
@@ -77,11 +77,11 @@ export function adapterErrorHandler(
     acc[name] = async (...args: any[]) => {
       try {
         logger.debug(`adapter_${name}`, { args })
-        const method: Method = adapter[name as any]
+        const method: Method = adapter[name as keyof Method]
         return await method(...args)
       } catch (error) {
-        logger.error(`adapter_error_${name}`, error)
-        const e = new UnknownError(error)
+        logger.error(`adapter_error_${name}`, error as Error)
+        const e = new UnknownError(error as Error)
         e.name = `${capitalize(name)}Error`
         throw e
       }
diff --git a/src/core/index.ts b/src/core/index.ts
index a16de951a3..7e11efceb6 100644
--- a/src/core/index.ts
+++ b/src/core/index.ts
@@ -195,7 +195,7 @@ export async function NextAuthHandler<
             logger[level](code, metadata)
           } catch (error) {
             // If logging itself failed...
-            logger.error("LOGGER_ERROR", error)
+            logger.error("LOGGER_ERROR", error as Error)
           }
         }
         return {}
diff --git a/src/core/lib/cookie.ts b/src/core/lib/cookie.ts
index c787228a0f..2b2b3ea2d5 100644
--- a/src/core/lib/cookie.ts
+++ b/src/core/lib/cookie.ts
@@ -1,11 +1,17 @@
 // REVIEW: Is there any way to defer two types of strings?
-
+import { NextAuthResponse } from "../../lib/types"
 import { CookiesOptions } from "../.."
 import { CookieOption } from "../types"
+import { ServerResponse } from "http"
 
 /** Stringified form of `JWT`. Extract the content with `jwt.decode` */
 export type JWTString = string
 
+export type SetCookieOptions = Partial<CookieOption["options"]> & {
+  expires?: Date | string
+  encode?: (val: unknown) => string
+}
+
 /** If `options.session.jwt` is set to `true`, this is a stringified `JWT`. In case of a database persisted session, this is the `sessionToken` of the session in the database.. */
 export type SessionToken<T extends "jwt" | "db" = "jwt"> = T extends "jwt"
   ? JWTString
@@ -22,13 +28,10 @@ export type SessionToken<T extends "jwt" | "db" = "jwt"> = T extends "jwt"
  * (with fixes for specific issues) to keep dependancy size down.
  */
 export function set(
-  res,
-  name,
-  value,
-  options: {
-    expires?: Date
-    maxAge?: number
-  } = {}
+  res: NextAuthResponse | ServerResponse,
+  name: string,
+  value: unknown,
+  options: SetCookieOptions = {}
 ) {
   const stringValue =
     typeof value === "object" ? "j:" + JSON.stringify(value) : String(value)
@@ -39,20 +42,24 @@ export function set(
   }
 
   // Preserve any existing cookies that have already been set in the same session
-  let setCookieHeader = res.getHeader("Set-Cookie") || []
+  let setCookieHeader = res.getHeader("Set-Cookie") ?? []
   // If not an array (i.e. a string with a single cookie) convert it into an array
   if (!Array.isArray(setCookieHeader)) {
-    setCookieHeader = [setCookieHeader]
+    setCookieHeader = [setCookieHeader.toString()]
   }
   setCookieHeader.push(_serialize(name, String(stringValue), options))
   res.setHeader("Set-Cookie", setCookieHeader)
 }
 
-function _serialize(name, val, options) {
+function _serialize(
+  name: string,
+  val: unknown,
+  options: SetCookieOptions = {}
+) {
   const fieldContentRegExp = /^[\u0009\u0020-\u007e\u0080-\u00ff]+$/ // eslint-disable-line no-control-regex
 
   const opt = options || {}
-  const enc = opt.encode || encodeURIComponent
+  const enc = opt.encode ?? encodeURIComponent
 
   if (typeof enc !== "function") {
     throw new TypeError("option encode is invalid")
@@ -62,7 +69,7 @@ function _serialize(name, val, options) {
     throw new TypeError("argument name is invalid")
   }
 
-  const value = enc(val)
+  const value = enc(val as string)
 
   if (value && !fieldContentRegExp.test(value)) {
     throw new TypeError("argument val is invalid")
@@ -99,9 +106,9 @@ function _serialize(name, val, options) {
   }
 
   if (opt.expires) {
-    let expires = opt.expires
-    if (typeof opt.expires.toUTCString === "function") {
-      expires = opt.expires.toUTCString()
+    let expires: Date | string = opt.expires
+    if (typeof (opt.expires as Date).toUTCString === "function") {
+      expires = (opt.expires as Date).toUTCString()
     } else {
       const dateExpires = new Date(opt.expires)
       expires = dateExpires.toUTCString()
@@ -154,7 +161,7 @@ function _serialize(name, val, options) {
  *
  * @TODO Review cookie settings (names, options)
  */
-export function defaultCookies(useSecureCookies): CookiesOptions {
+export function defaultCookies(useSecureCookies: boolean): CookiesOptions {
   const cookiePrefix = useSecureCookies ? "__Secure-" : ""
   return {
     // default cookie options
diff --git a/src/core/lib/email/signin.ts b/src/core/lib/email/signin.ts
index c073c8df70..9c8631d008 100644
--- a/src/core/lib/email/signin.ts
+++ b/src/core/lib/email/signin.ts
@@ -47,7 +47,7 @@ export default async function email(
     logger.error("SEND_VERIFICATION_EMAIL_ERROR", {
       identifier,
       url,
-      error,
+      error: error as Error,
     })
     throw new Error("SEND_VERIFICATION_EMAIL_ERROR")
   }
diff --git a/src/core/lib/oauth/authorization-url.ts b/src/core/lib/oauth/authorization-url.ts
index f4016d91d9..5eda92e170 100644
--- a/src/core/lib/oauth/authorization-url.ts
+++ b/src/core/lib/oauth/authorization-url.ts
@@ -67,7 +67,7 @@ export default async function getAuthorizationUrl(params: {
       cookies,
     }
   } catch (error) {
-    logger.error("GET_AUTHORIZATION_URL_ERROR", error)
+    logger.error("GET_AUTHORIZATION_URL_ERROR", error as Error)
     throw error
   }
 }
diff --git a/src/core/lib/oauth/callback.ts b/src/core/lib/oauth/callback.ts
index 0b1b9e1e86..1e36d9d41a 100644
--- a/src/core/lib/oauth/callback.ts
+++ b/src/core/lib/oauth/callback.ts
@@ -38,14 +38,14 @@ export default async function oAuthCallback(params: {
       const { oauth_token, oauth_verifier } = query ?? {}
       // @ts-expect-error
       const tokens: TokenSet = await client.getOAuthAccessToken(
-        oauth_token,
+        oauth_token as string,
         // @ts-expect-error
         null,
         oauth_verifier
       )
       // @ts-expect-error
       let profile: Profile = await client.get(
-        provider.profileUrl,
+        (provider as any).profileUrl,
         tokens.oauth_token,
         tokens.oauth_token_secret
       )
@@ -56,7 +56,7 @@ export default async function oAuthCallback(params: {
 
       return await getProfile({ profile, tokens, provider, logger })
     } catch (error) {
-      logger.error("OAUTH_V1_GET_ACCESS_TOKEN_ERROR", error)
+      logger.error("OAUTH_V1_GET_ACCESS_TOKEN_ERROR", error as Error)
       throw error
     }
   }
@@ -141,8 +141,8 @@ export default async function oAuthCallback(params: {
       cookies: pkce?.cookie ? [pkce.cookie] : undefined,
     }
   } catch (error) {
-    logger.error("OAUTH_CALLBACK_ERROR", { error, providerId: provider.id })
-    throw new OAuthCallbackError(error)
+    logger.error("OAUTH_CALLBACK_ERROR", { error: error as Error, providerId: provider.id })
+    throw new OAuthCallbackError(error as Error)
   }
 }
 
@@ -191,7 +191,10 @@ async function getProfile({
     // all providers, so we return an empty object; the user should then be
     // redirected back to the sign up page. We log the error to help developers
     // who might be trying to debug this when configuring a new provider.
-    logger.error("OAUTH_PARSE_PROFILE_ERROR", { error, OAuthProfile })
+    logger.error("OAUTH_PARSE_PROFILE_ERROR", {
+      error: error as Error,
+      OAuthProfile,
+    })
     return {
       profile: null,
       account: null,
diff --git a/src/core/lib/oauth/client-legacy.ts b/src/core/lib/oauth/client-legacy.ts
index d7776adbb5..2bc5a7ee0b 100644
--- a/src/core/lib/oauth/client-legacy.ts
+++ b/src/core/lib/oauth/client-legacy.ts
@@ -40,11 +40,11 @@ export function oAuth1Client(options: InternalOptions<"oauth">) {
     return await new Promise((resolve, reject) => {
       originalGetOAuth1AccessToken(
         ...args,
-        (error, oauth_token, oauth_token_secret) => {
+        (error: any, oauth_token: any, oauth_token_secret: any) => {
           if (error) {
             return reject(error)
           }
-          resolve({ oauth_token, oauth_token_secret })
+          resolve({ oauth_token, oauth_token_secret } as any)
         }
       )
     })
@@ -60,7 +60,7 @@ export function oAuth1Client(options: InternalOptions<"oauth">) {
           if (error) {
             return reject(error)
           }
-          resolve({ oauth_token, oauth_token_secret, params })
+          resolve({ oauth_token, oauth_token_secret, params } as any)
         }
       )
     })
diff --git a/src/core/lib/oauth/client.ts b/src/core/lib/oauth/client.ts
index 3192688d35..a25a79b44d 100644
--- a/src/core/lib/oauth/client.ts
+++ b/src/core/lib/oauth/client.ts
@@ -31,10 +31,8 @@ export async function openidClient(
 
   const client = new issuer.Client(
     {
-      // @ts-expect-error
-      client_id: provider.clientId,
-      // @ts-expect-error
-      client_secret: provider.clientSecret,
+      client_id: provider.clientId as string,
+      client_secret: provider.clientSecret as string,
       redirect_uris: [provider.callbackUrl],
       ...provider.client,
     },
diff --git a/src/core/lib/oauth/pkce-handler.ts b/src/core/lib/oauth/pkce-handler.ts
index 71c0c08a6e..be93f9b7b6 100644
--- a/src/core/lib/oauth/pkce-handler.ts
+++ b/src/core/lib/oauth/pkce-handler.ts
@@ -1,4 +1,4 @@
-import * as cookie from "../cookie"
+import { Cookie } from "../cookie"
 import * as jwt from "../../../jwt"
 import { generators } from "openid-client"
 import { InternalOptions } from "src/lib/types"
@@ -16,7 +16,17 @@ const PKCE_MAX_AGE = 60 * 15 // 15 minutes in seconds
  *  cookie: import("../cookie").Cookie
  * }>
  */
-export async function createPKCE(options) {
+
+type PKCE = Promise<
+  | undefined
+  | {
+      code_challenge: string
+      code_challenge_method: "S256"
+      cookie: Cookie
+    }
+>
+
+export async function createPKCE(options: InternalOptions<"oauth">): PKCE {
   const { cookies, logger } = options
   /** @type {import("src/providers").OAuthConfig} */
   const provider = options.provider
@@ -29,6 +39,7 @@ export async function createPKCE(options) {
 
   // Encrypt code_verifier and save it to an encrypted cookie
   const encryptedCodeVerifier = await jwt.encode({
+    // @ts-expect-error
     maxAge: PKCE_MAX_AGE,
     ...options.jwt,
     token: { code_verifier: codeVerifier },
@@ -68,7 +79,7 @@ export async function usePKCECodeVerifier(params: {
 }): Promise<
   | {
       codeVerifier?: string
-      cookie?: cookie.Cookie
+      cookie?: Cookie
     }
   | undefined
 > {
@@ -85,7 +96,7 @@ export async function usePKCECodeVerifier(params: {
   })
 
   // remove PKCE cookie after it has been used up
-  const cookie: cookie.Cookie = {
+  const cookie: Cookie = {
     name: cookies.pkceCodeVerifier.name,
     value: "",
     options: {
diff --git a/src/core/lib/providers.ts b/src/core/lib/providers.ts
index 35b5240ed1..bc90df3b68 100644
--- a/src/core/lib/providers.ts
+++ b/src/core/lib/providers.ts
@@ -36,25 +36,25 @@ export default function parseProviders(params: {
 function normalizeProvider(provider?: Provider) {
   if (!provider) return
 
-  const normalizedProvider: any = Object.entries(provider).reduce(
-    (acc, [key, value]) => {
-      if (
-        ["authorization", "token", "userinfo"].includes(key) &&
-        typeof value === "string"
-      ) {
-        const url = new URL(value)
-        acc[key] = {
-          url: `${url.origin}${url.pathname}`,
-          params: Object.fromEntries(url.searchParams ?? []),
-        }
-      } else {
-        acc[key] = value
+  const normalizedProvider: InternalProvider = Object.entries(
+    provider
+  ).reduce<InternalProvider>((acc, [key, value]) => {
+    if (
+      ["authorization", "token", "userinfo"].includes(key) &&
+      typeof value === "string"
+    ) {
+      const url = new URL(value)
+      ;(acc as any)[key] = {
+        url: `${url.origin}${url.pathname}`,
+        params: Object.fromEntries(url.searchParams ?? []),
       }
+    } else {
+      acc[key as keyof InternalProvider] = value
+    }
 
-      return acc
-    },
-    {}
-  )
+    return acc
+    // eslint-disable-next-line @typescript-eslint/prefer-reduce-type-parameter, @typescript-eslint/consistent-type-assertions
+  }, {} as InternalProvider)
 
   // Checks only work on OAuth 2.x + OIDC providers
   if (
@@ -62,7 +62,7 @@ function normalizeProvider(provider?: Provider) {
     !provider.version?.startsWith("1.") &&
     !provider.checks
   ) {
-    normalizedProvider.checks = ["state"]
+    ;(normalizedProvider as InternalProvider<"oauth">).checks = ["state"]
   }
-  return normalizedProvider as InternalProvider
+  return normalizedProvider
 }
diff --git a/src/core/lib/utils.ts b/src/core/lib/utils.ts
index 511d5aa76f..8449faa62a 100644
--- a/src/core/lib/utils.ts
+++ b/src/core/lib/utils.ts
@@ -8,7 +8,7 @@ import { InternalUrl } from "../../lib/parse-url"
  * Optionally takes a second date parameter. In that case
  * the date in the future will be calculated from that date instead of now.
  */
-export function fromDate(time, date = Date.now()) {
+export function fromDate(time: number, date = Date.now()) {
   return new Date(date + time * 1000)
 }
 
diff --git a/src/core/pages/error.tsx b/src/core/pages/error.tsx
index a4992862c0..35e764bf23 100644
--- a/src/core/pages/error.tsx
+++ b/src/core/pages/error.tsx
@@ -7,12 +7,19 @@ export interface ErrorProps {
   error?: string
 }
 
+interface ErrorView {
+  status: number
+  heading: string
+  message: JSX.Element
+  signin?: JSX.Element
+}
+
 /** Renders an error page. */
 export default function ErrorPage(props: ErrorProps) {
   const { url, error = "default", theme } = props
   const signinPageUrl = `${url}/signin`
 
-  const errors = {
+  const errors: Record<string, ErrorView> = {
     default: {
       status: 200,
       heading: "Error",
diff --git a/src/core/pages/index.ts b/src/core/pages/index.ts
index 909014a2a1..87047e4771 100644
--- a/src/core/pages/index.ts
+++ b/src/core/pages/index.ts
@@ -57,7 +57,7 @@ export default function renderPage({
         title: "Verify Request",
       })
     },
-    error(props) {
+    error(props?: any) {
       return send({
         ...ErrorPage({ url, theme, ...props }),
         title: "Error",
diff --git a/src/core/pages/signin.tsx b/src/core/pages/signin.tsx
index 81d6c26f86..2245317cd9 100644
--- a/src/core/pages/signin.tsx
+++ b/src/core/pages/signin.tsx
@@ -1,4 +1,16 @@
-export default function SigninPage(props) {
+import { Theme } from "../.."
+import { InternalProvider } from "../../lib/types"
+
+export interface SignInServerPageParams {
+  csrfToken: string
+  providers: InternalProvider[]
+  callbackUrl: string
+  email: string
+  error: string
+  theme: Theme
+}
+
+export default function SigninPage(props: SignInServerPageParams) {
   const {
     csrfToken,
     providers,
@@ -20,14 +32,14 @@ export default function SigninPage(props) {
     return false
   })
 
-  if (typeof document !== "undefined") {
+  if (typeof document !== "undefined" && theme.brandColor) {
     document.documentElement.style.setProperty(
       "--brand-color",
       theme.brandColor
     )
   }
 
-  const errors = {
+  const errors: Record<string, string> = {
     Signin: "Try signing in with a different account.",
     OAuthSignin: "Try signing in with a different account.",
     OAuthCallback: "Try signing in with a different account.",
@@ -109,14 +121,14 @@ export default function SigninPage(props) {
                         className="section-header"
                         htmlFor={`input-${credential}-for-${provider.id}-provider`}
                       >
-                        {provider.credentials[credential].label || credential}
+                        {provider.credentials[credential].label ?? credential}
                       </label>
                       <input
                         name={credential}
                         id={`input-${credential}-for-${provider.id}-provider`}
-                        type={provider.credentials[credential].type || "text"}
+                        type={provider.credentials[credential].type ?? "text"}
                         placeholder={
-                          provider.credentials[credential].placeholder ||
+                          provider.credentials[credential].placeholder ??
                           "Password"
                         }
                         {...provider.credentials[credential]}
diff --git a/src/core/routes/callback.ts b/src/core/routes/callback.ts
index 6bd4e90434..233c14e370 100644
--- a/src/core/routes/callback.ts
+++ b/src/core/routes/callback.ts
@@ -4,6 +4,7 @@ import * as cookie from "../lib/cookie"
 import { hashToken } from "../lib/utils"
 import { InternalOptions } from "../../lib/types"
 import { IncomingRequest, OutgoingResponse } from ".."
+import { User } from "../.."
 
 /** Handle callbacks from login services */
 export default async function callback(params: {
@@ -99,7 +100,9 @@ export default async function callback(params: {
           }
         } catch (error) {
           return {
-            redirect: `${url}/error?error=${encodeURIComponent(error.message)}`,
+            redirect: `${url}/error?error=${encodeURIComponent(
+              (error as Error).message
+            )}`,
             cookies,
           }
         }
@@ -175,24 +178,24 @@ export default async function callback(params: {
         // Callback URL is already verified at this point, so safe to use if specified
         return { redirect: callbackUrl, cookies }
       } catch (error) {
-        if (error.name === "AccountNotLinkedError") {
+        if ((error as Error).name === "AccountNotLinkedError") {
           // If the email on the account is already linked, but not with this OAuth account
           return {
             redirect: `${url}/error?error=OAuthAccountNotLinked`,
             cookies,
           }
-        } else if (error.name === "CreateUserError") {
+        } else if ((error as Error).name === "CreateUserError") {
           return { redirect: `${url}/error?error=OAuthCreateAccount`, cookies }
         }
-        logger.error("OAUTH_CALLBACK_HANDLER_ERROR", error)
+        logger.error("OAUTH_CALLBACK_HANDLER_ERROR", error as Error)
         return { redirect: `${url}/error?error=Callback`, cookies }
       }
     } catch (error) {
-      if (error.name === "OAuthCallbackError") {
-        logger.error("CALLBACK_OAUTH_ERROR", error)
+      if ((error as Error).name === "OAuthCallbackError") {
+        logger.error("CALLBACK_OAUTH_ERROR", error as Error)
         return { redirect: `${url}/error?error=OAuthCallback`, cookies }
       }
-      logger.error("OAUTH_CALLBACK_ERROR", error)
+      logger.error("OAUTH_CALLBACK_ERROR", error as Error)
       return { redirect: `${url}/error?error=Callback`, cookies }
     }
   } else if (provider.type === "email") {
@@ -251,7 +254,9 @@ export default async function callback(params: {
         }
       } catch (error) {
         return {
-          redirect: `${url}/error?error=${encodeURIComponent(error.message)}`,
+          redirect: `${url}/error?error=${encodeURIComponent(
+            (error as Error).message
+          )}`,
           cookies,
         }
       }
@@ -327,10 +332,10 @@ export default async function callback(params: {
       // Callback URL is already verified at this point, so safe to use if specified
       return { redirect: callbackUrl, cookies }
     } catch (error) {
-      if (error.name === "CreateUserError") {
+      if ((error as Error).name === "CreateUserError") {
         return { redirect: `${url}/error?error=EmailCreateAccount`, cookies }
       }
-      logger.error("CALLBACK_EMAIL_ERROR", error)
+      logger.error("CALLBACK_EMAIL_ERROR", error as Error)
       return { redirect: `${url}/error?error=Callback`, cookies }
     }
   } else if (provider.type === "credentials" && method === "POST") {
@@ -364,14 +369,14 @@ export default async function callback(params: {
 
     const credentials = body
 
-    let user
+    let user: User
     try {
-      user = await provider.authorize(credentials, {
+      user = (await provider.authorize(credentials, {
         query,
         body,
         headers,
         method,
-      })
+      })) as User
       if (!user) {
         return {
           status: 401,
@@ -384,7 +389,9 @@ export default async function callback(params: {
       }
     } catch (error) {
       return {
-        redirect: `${url}/error?error=${encodeURIComponent(error.message)}`,
+        redirect: `${url}/error?error=${encodeURIComponent(
+          (error as Error).message
+        )}`,
         cookies,
       }
     }
@@ -414,7 +421,9 @@ export default async function callback(params: {
       }
     } catch (error) {
       return {
-        redirect: `${url}/error?error=${encodeURIComponent(error.message)}`,
+        redirect: `${url}/error?error=${encodeURIComponent(
+          (error as Error).message
+        )}`,
         cookies,
       }
     }
diff --git a/src/core/routes/providers.ts b/src/core/routes/providers.ts
index 400ddad52d..41d4c43366 100644
--- a/src/core/routes/providers.ts
+++ b/src/core/routes/providers.ts
@@ -19,7 +19,7 @@ export default function providers(
 ): OutgoingResponse<Record<string, PublicProvider>> {
   return {
     headers: [{ key: "Content-Type", value: "application/json" }],
-    body: providers.reduce(
+    body: providers.reduce<Record<string, PublicProvider>>(
       (acc, { id, name, type, signinUrl, callbackUrl }) => {
         acc[id] = { id, name, type, signinUrl, callbackUrl }
         return acc
diff --git a/src/core/routes/session.ts b/src/core/routes/session.ts
index 7aa073a654..37bc574b59 100644
--- a/src/core/routes/session.ts
+++ b/src/core/routes/session.ts
@@ -77,7 +77,7 @@ export default async function session(
       await events.session?.({ session, token })
     } catch (error) {
       // If JWT not verifiable, make sure the cookie for it is removed and return empty object
-      logger.error("JWT_SESSION_ERROR", error)
+      logger.error("JWT_SESSION_ERROR", (error as Error))
 
       response.cookies?.push({
         name: options.cookies.sessionToken.name,
@@ -160,7 +160,7 @@ export default async function session(
         })
       }
     } catch (error) {
-      logger.error("SESSION_ERROR", error)
+      logger.error("SESSION_ERROR", (error as Error))
     }
   }
 
diff --git a/src/core/routes/signin.ts b/src/core/routes/signin.ts
index 0ec1b910a3..4c5977075f 100644
--- a/src/core/routes/signin.ts
+++ b/src/core/routes/signin.ts
@@ -26,7 +26,7 @@ export default async function signin(params: {
       const response = await getAuthorizationUrl({ options, query })
       return response
     } catch (error) {
-      logger.error("SIGNIN_OAUTH_ERROR", { error, provider })
+      logger.error("SIGNIN_OAUTH_ERROR", { error: error as Error, provider })
       return { redirect: `${url}/error?error=OAuthSignin` }
     }
   } else if (provider.type === "email") {
@@ -73,13 +73,17 @@ export default async function signin(params: {
         return { redirect: signInCallbackResponse }
       }
     } catch (error) {
-      return { redirect: `${url}/error?${new URLSearchParams({ error })}}` }
+      return {
+        redirect: `${url}/error?${new URLSearchParams({
+          error: error as string,
+        })}}`,
+      }
     }
 
     try {
       await emailSignin(email, options)
     } catch (error) {
-      logger.error("SIGNIN_EMAIL_ERROR", error)
+      logger.error("SIGNIN_EMAIL_ERROR", (error as Error))
       return { redirect: `${url}/error?error=EmailSignin` }
     }
 
diff --git a/src/core/routes/signout.ts b/src/core/routes/signout.ts
index 51b84f9149..b9d3017a1b 100644
--- a/src/core/routes/signout.ts
+++ b/src/core/routes/signout.ts
@@ -34,7 +34,7 @@ export default async function signout(params: {
       await events.signOut?.({ session })
     } catch (error) {
       // If error, log it but continue
-      logger.error("SIGNOUT_ERROR", error)
+      logger.error("SIGNOUT_ERROR", error as Error)
     }
   }
 
diff --git a/src/core/types.ts b/src/core/types.ts
index 2d33e9830f..79dcf9d9d0 100644
--- a/src/core/types.ts
+++ b/src/core/types.ts
@@ -345,7 +345,7 @@ export interface CookieOption {
     secure: boolean
     maxAge?: number
     domain?: string
-    expires?: Date
+    expires?: Date | string
   }
 }
 
diff --git a/src/jwt/index.ts b/src/jwt/index.ts
index 0eb0d43b0d..0e30147688 100644
--- a/src/jwt/index.ts
+++ b/src/jwt/index.ts
@@ -1,5 +1,5 @@
 import { EncryptJWT, jwtDecrypt } from "jose"
-import hkdf from '@panva/hkdf'
+import hkdf from "@panva/hkdf"
 import { v4 as uuid } from "uuid"
 import { NextApiRequest } from "next"
 import type { JWT, JWTDecodeParams, JWTEncodeParams, JWTOptions } from "./types"
@@ -99,9 +99,9 @@ export async function getToken<R extends boolean = false>(
   }
 }
 
-async function getDerivedEncryptionKey(secret) {
+async function getDerivedEncryptionKey(secret: string | Buffer) {
   return await hkdf(
-    'sha256',
+    "sha256",
     secret,
     "",
     "NextAuth.js Generated Encryption Key",
diff --git a/src/jwt/types.ts b/src/jwt/types.ts
index bc9bf4fca7..2aa848346b 100644
--- a/src/jwt/types.ts
+++ b/src/jwt/types.ts
@@ -46,3 +46,5 @@ export interface JWTOptions {
   /** Override this method to control the NextAuth.js issued JWT decoding. */
   decode: typeof decode
 }
+
+export type Secret = string | Buffer
diff --git a/src/lib/logger.ts b/src/lib/logger.ts
index c55c0470b7..ab03d536e5 100644
--- a/src/lib/logger.ts
+++ b/src/lib/logger.ts
@@ -1,23 +1,30 @@
 import { UnknownError } from "../core/errors"
 
+// TODO: better typing
 /** Makes sure that error is always serializable */
-function formatError(o) {
+function formatError(o: unknown): unknown {
   if (o instanceof Error && !(o instanceof UnknownError)) {
     return { message: o.message, stack: o.stack, name: o.name }
   }
-  if (o?.error) {
-    o.error = formatError(o.error)
+  if (hasErrorProperty(o)) {
+    o.error = formatError(o.error) as Error
     o.message = o.message ?? o.error.message
   }
   return o
 }
 
+function hasErrorProperty(
+  x: unknown
+): x is { error: Error; [key: string]: unknown } {
+  return !!(x as any)?.error
+}
+
 /**
  * Override any of the methods, and the rest will use the default logger.
  *
  * [Documentation](https://next-auth.js.org/configuration/options#logger)
  */
-export interface LoggerInstance {
+export interface LoggerInstance extends Record<string, Function> {
   warn: (
     code:
       | "JWT_AUTO_GENERATED_SIGNING_KEY"
@@ -39,7 +46,7 @@ export interface LoggerInstance {
 
 const _logger: LoggerInstance = {
   error(code, metadata) {
-    metadata = formatError(metadata)
+    metadata = formatError(metadata) as Error
     console.error(
       `[next-auth][error][${code}]`,
       `\nhttps://next-auth.js.org/errors#${code.toLowerCase()}`,
@@ -81,15 +88,15 @@ export function proxyLogger(
       return logger
     }
 
-    const clientLogger = {}
+    const clientLogger: Record<string, unknown> = {}
     for (const level in logger) {
-      clientLogger[level] = (code, metadata) => {
+      clientLogger[level] = (code: string, metadata: Error) => {
         _logger[level](code, metadata) // Logs to console
 
         if (level === "error") {
-          metadata = formatError(metadata)
+          metadata = formatError(metadata) as Error
         }
-        metadata.client = true
+        ;(metadata as any).client = true
         const url = `${basePath}/_log`
         const body = new URLSearchParams({ level, code, ...metadata })
         if (navigator.sendBeacon) {
@@ -98,7 +105,7 @@ export function proxyLogger(
         return fetch(url, { method: "POST", body, keepalive: true })
       }
     }
-    return clientLogger as LoggerInstance
+    return clientLogger as unknown as LoggerInstance
   } catch {
     return _logger
   }
diff --git a/src/lib/merge.ts b/src/lib/merge.ts
index 965a850785..ad75850177 100644
--- a/src/lib/merge.ts
+++ b/src/lib/merge.ts
@@ -6,7 +6,7 @@ function isObject(item: any): boolean {
 }
 
 /** Deep merge two objects */
-export function merge(target: any, ...sources: any[]) {
+export function merge(target: any, ...sources: any[]): any {
   if (!sources.length) return target
   const source = sources.shift()
 
diff --git a/src/next/index.ts b/src/next/index.ts
index 58df318f23..c0f44a930e 100644
--- a/src/next/index.ts
+++ b/src/next/index.ts
@@ -5,7 +5,7 @@ import {
 } from "next"
 import { NextAuthOptions, Session } from ".."
 import { NextAuthHandler } from "../core"
-import { NextAuthAction } from "../lib/types"
+import { NextAuthAction, NextAuthRequest, NextAuthResponse } from "../lib/types"
 import { set as setCookie } from "../core/lib/cookie"
 import logger, { setLogger } from "../lib/logger"
 
@@ -81,9 +81,14 @@ function NextAuth(
 ): any
 
 /** Tha main entry point to next-auth */
-function NextAuth(...args) {
+function NextAuth(
+  ...args:
+    | [NextAuthOptions]
+    | [NextApiRequest, NextApiResponse, NextAuthOptions]
+) {
   if (args.length === 1) {
-    return async (req, res) => await NextAuthNextHandler(req, res, args[0])
+    return async (req: NextAuthRequest, res: NextAuthResponse) =>
+      await NextAuthNextHandler(req, res, args[0])
   }
 
   return NextAuthNextHandler(args[0], args[1], args[2])
diff --git a/src/providers/credentials.ts b/src/providers/credentials.ts
index 5a45b41cda..c0e061738f 100644
--- a/src/providers/credentials.ts
+++ b/src/providers/credentials.ts
@@ -10,7 +10,7 @@ export interface CredentialInput {
 }
 
 export interface CredentialsConfig<
-  C extends Record<string, CredentialInput> = {}
+  C extends Record<string, CredentialInput> = Record<string, CredentialInput>
 > extends CommonProviderOptions {
   type: "credentials"
   credentials: C
diff --git a/src/react/index.tsx b/src/react/index.tsx
index a8ec722871..a36af4f616 100644
--- a/src/react/index.tsx
+++ b/src/react/index.tsx
@@ -352,7 +352,7 @@ export function SessionProvider(props: SessionProviderProps) {
         __NEXTAUTH._session = await getSession()
         setSession(__NEXTAUTH._session)
       } catch (error) {
-        logger.error("CLIENT_SESSION_ERROR", error)
+        logger.error("CLIENT_SESSION_ERROR", error as Error)
       } finally {
         setLoading(false)
       }
diff --git a/tsconfig.json b/tsconfig.json
index 60f3814805..53e6e4d2c8 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -16,14 +16,9 @@
     "isolatedModules": true,
     "jsx": "react-jsx",
     "declaration": true,
-    "stripInternal": true
+    "stripInternal": true,
+    "skipLibCheck": true,
+    "skipDefaultLibCheck": true
   },
-  "exclude": [
-    "./*.js",
-    "./*.d.ts",
-    "app",
-    "**/tests",
-    "**/__tests__",
-    "config"
-  ]
+  "exclude": ["./*.js", "./*.d.ts", "app", "**/tests", "**/__tests__", "config"]
 }