SuperTokens
Open-core authentication you can self-host with full data ownership.
About
SuperTokens is an open-core alternative to proprietary login providers like Auth0, Firebase Auth and AWS Cognito. It is built around a three-tier architecture: frontend SDKs that render login UI and manage session tokens, backend SDKs for sign-up and session APIs, and the SuperTokens Core service that holds the auth logic and database operations.
It covers email-password login, passwordless magic links and OTP, social login, TOTP-based MFA, multi-tenancy with enterprise SSO via SAML and OIDC, user roles, and session management with rotating refresh tokens and token-theft detection. The core carries close to 15,000 GitHub stars, and the free tier supports up to 5,000 monthly active users, with self-hosting free forever.
What it can do
- Password, passwordless, social and phone login recipes
- Session management with rotating refresh tokens
- Multi-tenancy, RBAC and enterprise SSO
- Self-hostable core with a managed cloud option
Setup
Deploy SuperTokens Core with Docker, add the backend and frontend SDKs, or start on the managed cloud.
Prerequisites
Your app's backend runtime; Docker or a database for self-hosting.
Use cases
Works with
Trust score — 8/10
Scored 8/10 (verified tier, metrics-v1). Evidence: Verified via vendor site/docs/GitHub and reputable coverage, wave 92; Trending score 78/100 from researcher assessment.
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.