Skip to content
SPECIFICTION
Get listed

SuperTokens

supertokens.com

From $0.01/mo Free plan Open source WebLinuxiOSAndroidAPISelf-hosted
Visit supertokens.com
Spec score 8.9 #3 of 25 in Multi-Factor Authentication APIs

What it is

SuperTokens is an open-source authentication provider for developers adding sign-in and session management to applications. It supports email and password, passwordless email or SMS codes, magic links, social login, and passkeys. Enterprise options include tenant-specific login methods, separate user pools, and enterprise SSO. Developers can adapt the prebuilt interface and add logic before or after API operations with hooks and overrides. Backend SDKs communicate with SuperTokens Core; frontend SDKs call authentication routes exposed by the application backend. Core can be self-hosted, with open-source features free at any scale and no MAU limit. A managed Cloud plan is also available, free under 5K MAUs and then $0.02 per MAU. Other paid or sales-led features include multi-tenancy, cross-domain unified login, machine-to-machine authentication, availability zones with uptime SLAs, and Attack Protection Suite. That suite can detect risky authentication activity and prompt extra verification or block attempts. Integrations include Next.js, NestJS, GraphQL, Capacitor, AWS Lambda, Vercel, Hasura, and Supabase. SuperTokens says it is SOC 2 compliant and describes more than 100 controls and tests.

Spec sheet

What it does
SuperTokens provides open-source authentication and session management that runs through an application backend and can be self-hosted or consumed as a managed service.Read 15 Oct 2026 · supertokens.com
Product
SuperTokens is an open-source authentication provider for adding customizable authentication and session management to applications.Read 30 Sep 2026 · supertokens.com
Intended users
The company describes its product as an open-source user authentication provider for developers and says it serves startups and enterprises.Read 30 Sep 2026 · supertokens.com
Integrations
The homepage lists support for JavaScript, Go, Python, React, Angular, Vue, Android, Flutter, and iOS, and says it works with more than 25 frameworks.Read 15 Oct 2026 · supertokens.com
Security
The product page says SuperTokens is SOC 2 compliant and describes more than 100 controls and tests.Read 30 Sep 2026 · supertokens.com
Compliance
The pricing page lists SOC 2 compliance among the core features.Read 15 Oct 2026 · supertokens.com
Support
Professional support can include migration and implementation assistance, several support channels, and guaranteed response times from 2 hours to 2 days.Read 30 Sep 2026 · supertokens.com
Founded
2019Read 28 Sep 2026 · supertokens.com
API and extensibility
Backend SDKs expose sign-up, sign-in, sign-out, session-refresh, and related authentication APIs, while recipes provide composable extension points.Read 15 Oct 2026 · github.com
Architecture
The frontend SDK talks to the application backend, which communicates with SuperTokens Core; the frontend does not call Core directly.Read 15 Oct 2026 · supertokens.com
Attack protection
The Attack Protection Suite detects risky authentication activity and can trigger extra verification or block attempts; its documentation marks the feature beta and disabled by default.Read 15 Oct 2026 · supertokens.com
Authentication methods
The platform supports email/password, passwordless magic links or OTPs, social login, passkeys, MFA, unified login, machine-to-machine authentication, and enterprise multitenancy.Read 15 Oct 2026 · supertokens.com
Company founding
Crunchbase lists the company as founded in 2019.Read 15 Oct 2026 · crunchbase.com
Company legal name and founders
Crunchbase identifies the legal name as SuperTokens, Inc. and lists Advait Ruia and Rishabh Poddar as co-founders.Read 15 Oct 2026 · crunchbase.com
Company LinkedIn profile
LinkedIn lists SuperTokens as a privately held software-development company headquartered in San Francisco with 2–10 employees.Read 15 Oct 2026 · linkedin.com
Company milestone
The company’s own history says it entered Y Combinator in summer 2020 and raised additional venture capital in December 2023.Read 15 Oct 2026 · supertokens.com
Customization
Prebuilt UI components can be customized, and hooks or overrides can add logic before or after authentication APIs.Read 15 Oct 2026 · supertokens.com
Deployment tooling
The independent developer guide lists official Docker images and Kubernetes deployment as supported self-hosting approaches.Read 15 Oct 2026 · zairalabs.ai
Documentation
The documentation includes quickstarts, migration guidance, integration guides, API references, security material, and deployment instructions.Read 15 Oct 2026 · supertokens.com
Email and password
Email/password authentication includes customizable forms, email verification, and password-reset flows.Read 15 Oct 2026 · supertokens.com
Enterprise and multitenancy
Enterprise login supports tenant-specific login methods, isolated user pools, and enterprise SSO.Read 15 Oct 2026 · supertokens.com
Enterprise authentication
It offers tenant-specific login methods, isolated user pools, and enterprise SSO.Read 30 Sep 2026 · supertokens.com
Funding
Crunchbase lists four seed funding rounds and investors including WestWave Capital and Irregular Expressions, but the displayed dollar amounts are obscured.Read 15 Oct 2026 · crunchbase.com
Licence
The public portions of SuperTokens Core are licensed under Apache 2.0, while the ee directory is governed by a separate enterprise licence.Read 15 Oct 2026 · github.com
Limit: enterprise IAM
An independent review says SuperTokens is a weaker fit when an organization needs broad enterprise IAM such as LDAP or advanced SSO governance.Read 15 Oct 2026 · gautamkhorana.com
Limit: G2 reviewer complaint
The G2 reviewer said caching for higher performance was not supported.Read 15 Oct 2026 · g2.com
Limit: Gartner reviewer
The Gartner reviewer said the default UI has limited customization for a specific brand.Read 15 Oct 2026 · gartner.com
Limit: operations
An independent guide says self-hosting adds a stateful service, database management, monitoring, backups, schema versioning, and another failure domain.Read 15 Oct 2026 · zairalabs.ai
Limit: UI polish
An independent review characterizes the prebuilt components as functional and says many teams customize or replace them.Read 15 Oct 2026 · gautamkhorana.com
Multi-factor authentication
MFA can use email or SMS OTP, TOTP, or passkeys and can require step-up verification for sensitive actions.Read 15 Oct 2026 · supertokens.com
Notable changelog
SuperTokens Core v12.2.0 was released on September 4, 2026 and included database-schema startup checks, signing-key rotation changes, SAML fixes, and security updates.Read 15 Oct 2026 · github.com
Paid features
The pricing page lists multi-tenancy, unified login across multiple domains, machine-to-machine authentication, availability zones with uptime SLAs, and Attack Protection Suite among paid or contact-sales features.Read 30 Sep 2026 · supertokens.com
Passwordless
Passwordless authentication can send one-time passwords or magic links by email or SMS.Read 15 Oct 2026 · supertokens.com
Praise: G2 reviewers
The sole G2 reviewer praised the security features, easy implementation, documentation, and support.Read 15 Oct 2026 · g2.com
Praise: Gartner reviewer
The Gartner reviewer described integration with an existing stack and documentation as easy and effective.Read 15 Oct 2026 · gartner.com
Praise: Trustpilot reviewer
The Trustpilot reviewer praised the security features, speed, documentation, and Discord support for session management.Read 15 Oct 2026 · trustpilot.com
Rating on G2
5.0 out of 5 from 1 review.Read 15 Oct 2026 · g2.com
Rating on Gartner Peer Insights
5.0 out of 5 from 1 review.Read 15 Oct 2026 · gartner.com
Rating on Trustpilot
3.7 out of 5 from 1 review.Read 15 Oct 2026 · trustpilot.com
SDKs
Official backend SDKs are provided for Node.js, Python, and Go, with frontend SDKs for React, vanilla JavaScript, React Native, iOS, Flutter, and Android.Read 15 Oct 2026 · supertokens.com
Security controls
Session cookies are generated with the Secure flag, and the security documentation describes token and cookie protections.Read 15 Oct 2026 · supertokens.com
Self-hosting
SuperTokens Core can be deployed on the customer’s infrastructure with the customer’s database, while the managed service handles scaling, reliability, and updates.Read 15 Oct 2026 · supertokens.com
Session management
The product manages sessions and exposes route protection and authenticated-user helpers.Read 15 Oct 2026 · supertokens.com
Sessions and APIs
Backend SDKs communicate with SuperTokens Core, while frontend SDKs send requests to authentication routes exposed by the application backend.Read 30 Sep 2026 · supertokens.com
Social login
Social login supports providers such as Google, Apple, GitHub, and other identity providers.Read 15 Oct 2026 · supertokens.com
System requirements
A production self-hosted Core deployment requires a persistent database connection; in-memory mode is intended for testing and loses state after restart.Read 15 Oct 2026 · zairalabs.ai
Telemetry
Core and backend SDK telemetry can be disabled through configuration, although license-key statistics require a separate stateless-key request to suppress.Read 15 Oct 2026 · github.com
Update process
Self-hosted Core upgrades require shutting down Core and running migration scripts for every intervening version; SDKs have separate compatibility and changelog guidance.Read 15 Oct 2026 · supertokens.com

Plans and prices

Self-hosted Free Open-source features free at any scale · paid add-ons available · customer operates infrastructure Read 15 Oct 2026 · supertokens.com
Self-hosted open source Free Free at any scale for open source features Open source features · no MAU limit · paid add-ons available Read 30 Sep 2026 · supertokens.com
Account Linking add-on $0.01 a month $0.005 / MAU Minimum Billing of $100 / month Read 30 Sep 2026 · supertokens.com
Multi-factor authentication add-on $0.01 a month $0.01 / MAU; Minimum Billing of $100 / month MFA add-on · $100 minimum monthly billing Read 30 Sep 2026 · supertokens.com
Cloud $0.02 a month per monthly active user (MAU); free under 5,000 MAUs Core authentication and session features · paid add-ons · $100 monthly minimum for MFA or account linking Read 15 Oct 2026 · supertokens.com
Dashboard users $20 a month $20 / user / month 3 free users Read 30 Sep 2026 · supertokens.com

Every SuperTokens plan and price →

Strong points and limits

Strong points

  • Open-source features are free at any scale.
  • Supports passkeys, social login, and passwordless methods.
  • Prebuilt UI can be customized with hooks and overrides.
  • Offers tenant-specific methods and enterprise SSO.
  • Attack Protection Suite can prompt verification or block attempts.

Limits

  • Managed Cloud costs $0.02 per MAU.
  • MFA add-on has a $100 monthly minimum.
  • Account Linking add-on has a $100 monthly minimum.
  • Several advanced features are paid or contact-sales.

Who it suits

It suits developers at startups or enterprises who need customizable authentication and session management. Self-hosting is an option for teams seeking open-source features without an MAU limit.

Verdict

SuperTokens combines a self-hostable open-source core with a managed cloud option and a broad set of authentication methods. Check add-on minimums and which enterprise capabilities require paid plans or a sales inquiry.

Where Specifiction places it

Alternatives to SuperTokensAll alternatives →