SuperTokens
SuperTokens is an open-source authentication provider for developers adding customizable sign-in and session management to applications.
What SuperTokens is
SuperTokens is an open-source authentication provider for developers adding customizable sign-in and session management to applications. It supports email and password, passwordless email or SMS one-time codes, magic links, social login, and passkeys. Developers can tailor its prebuilt UI and add pre- or post-API logic through hooks and overrides. Backend SDKs communicate with SuperTokens Core, while frontend SDKs send requests to authentication routes exposed by the application backend. The Core can be self-hosted, and open-source features are free at any scale with no MAU limit. A managed Cloud plan is billed at $0.02 per MAU, with free use under 5K MAUs. Integrations documentation lists frameworks and services including Next.js, NestJS, GraphQL, Vercel, Hasura, and Supabase. Enterprise options include tenant-specific login methods, isolated user pools, and enterprise SSO. Paid features also include multi-tenancy, unified login across domains, machine-to-machine authentication, availability zones with uptime SLAs, and the Attack Protection Suite. The company says SuperTokens is SOC 2 compliant and describes more than 100 controls and tests.
Good
- Open-source features are free at any scale.
- No MAU limit for self-hosted open-source features.
- Supports passwordless methods, social login, and passkeys.
- Prebuilt UI can be customized.
- Integrations include Next.js, GraphQL, and Supabase.
Watch out
- MFA add-on has a $100 minimum monthly billing.
- Account Linking add-on has a $100 minimum monthly billing.
- Several advanced features are paid or require contacting sales.
Who it suits
SuperTokens is for developers building authentication and session management into applications, from startups to enterprises. It suits teams that want to self-host open-source features or use the managed Cloud plan.
Verdict
SuperTokens offers a self-hosted open-source route and a managed Cloud plan, with multiple authentication methods and integration options. Review add-on minimums and paid-feature availability against your intended setup.
Plans and prices
From SuperTokens's own pricing page, checked 15 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Self-hosted | Free | Open-source features free at any scale · paid add-ons available · customer operates infrastructure |
| Self-hosted open source | Free | Open source features · no MAU limit · paid add-ons available · Free at any scale for open source features |
| Account Linking add-on | $0.01 a month | Minimum Billing of $100 / month · $0.005 / MAU |
| Multi-factor authentication add-on | $0.01 a month | MFA add-on · $100 minimum monthly billing · $0.01 / MAU; Minimum Billing of $100 / month |
| Cloud | $0.02 a month | Core authentication and session features · paid add-ons · $100 monthly minimum for MFA or account linking · per monthly active user (MAU); free under 5,000 MAUs |
| Dashboard users | $20 a month | 3 free users · $20 / user / month |
The facts
Each one read from SuperTokens's own pages, with the date it was checked.
What it does
- API and extensibility
- Backend SDKs expose sign-up, sign-in, sign-out, session-refresh, and related authentication APIs, while recipes provide composable extension points.checked 15 Oct 2026
- Architecture
- The frontend SDK talks to the application backend, which communicates with SuperTokens Core; the frontend does not call Core directly.checked 15 Oct 2026
- Attack protection
- The Attack Protection Suite detects risky authentication activity and can trigger extra verification or block attempts; its documentation marks the feature beta and disabled by default.checked 15 Oct 2026
- Authentication methods
- The platform supports email/password, passwordless magic links or OTPs, social login, passkeys, MFA, unified login, machine-to-machine authentication, and enterprise multitenancy.checked 15 Oct 2026
- Compliance
- The pricing page lists SOC 2 compliance among the core features.checked 15 Oct 2026
- Customization
- Prebuilt UI components can be customized, and hooks or overrides can add logic before or after authentication APIs.checked 15 Oct 2026
- Deployment tooling
- The independent developer guide lists official Docker images and Kubernetes deployment as supported self-hosting approaches.checked 15 Oct 2026
- Documentation
- The documentation includes quickstarts, migration guidance, integration guides, API references, security material, and deployment instructions.checked 15 Oct 2026
- Email and password
- Email/password authentication includes customizable forms, email verification, and password-reset flows.checked 15 Oct 2026
- Enterprise and multitenancy
- Enterprise login supports tenant-specific login methods, isolated user pools, and enterprise SSO.checked 15 Oct 2026
- Enterprise authentication
- It offers tenant-specific login methods, isolated user pools, and enterprise SSO.checked 30 Sep 2026
- Funding
- Crunchbase lists four seed funding rounds and investors including WestWave Capital and Irregular Expressions, but the displayed dollar amounts are obscured.checked 15 Oct 2026
- Integrations
- The homepage lists support for JavaScript, Go, Python, React, Angular, Vue, Android, Flutter, and iOS, and says it works with more than 25 frameworks.checked 15 Oct 2026
- Intended users
- The company describes its product as an open-source user authentication provider for developers and says it serves startups and enterprises.checked 30 Sep 2026
- Licence
- The public portions of SuperTokens Core are licensed under Apache 2.0, while the ee directory is governed by a separate enterprise licence.checked 15 Oct 2026
- Limit: enterprise IAM
- An independent review says SuperTokens is a weaker fit when an organization needs broad enterprise IAM such as LDAP or advanced SSO governance.checked 15 Oct 2026
- Limit: G2 reviewer complaint
- The G2 reviewer said caching for higher performance was not supported.checked 15 Oct 2026
- Limit: Gartner reviewer
- The Gartner reviewer said the default UI has limited customization for a specific brand.checked 15 Oct 2026
- Limit: operations
- An independent guide says self-hosting adds a stateful service, database management, monitoring, backups, schema versioning, and another failure domain.checked 15 Oct 2026
The company
- Company founding
- Crunchbase lists the company as founded in 2019.checked 15 Oct 2026
- Company legal name and founders
- Crunchbase identifies the legal name as SuperTokens, Inc. and lists Advait Ruia and Rishabh Poddar as co-founders.checked 15 Oct 2026
- Company LinkedIn profile
- LinkedIn lists SuperTokens as a privately held software-development company headquartered in San Francisco with 2–10 employees.checked 15 Oct 2026
- Company milestone
- The company’s own history says it entered Y Combinator in summer 2020 and raised additional venture capital in December 2023.checked 15 Oct 2026
- Founded
- 2019checked 28 Sep 2026
Alternatives to SuperTokens
- 1
Bitwarden
Free planOpen sourceAndroidiOSWebAPI8.6From $1.65 a month - 2
Ory
Free planOpen sourceWebAPILinuxmacOS8.4From $770 a year - 3
FusionAuth
Free planAndroidiOSWebAPI8.3From $162 a month - 4
Authio Lobby
Free planAndroidiOSWebAPI8.1From $129 a month - 5
Descope
Free planAndroidiOSWebAPI7.6From $249 a month - 6
Okta Customer Identity Cloud
Free planAndroidiOSWebAPI7.6From $35 a month