LinOTP vs SuperTokens

LinOTP is an open-source platform for multi-factor authentication, aimed at protecting digital identities and transactions. It supports factors including HOTP, TOTP, mOTP, OCRA, SMS and email codes, push, QR, YubiKey, FIDO U2F, WebAuthn, and other hardware tokens. Listed protocols include SAML, OIDC, ADFS, and RADIUS; app integration methods also include HTTP/JSON API, PAM, OpenVPN, SSH, Apache, and WordPress. LinOTP connects to Active Directory, LDAP, and SQL databases including PostgreSQL, MySQL, MariaDB, Oracle, and DB2. A self-service portal lets users register, manage, and reset tokens, while hardware tokens can be resynchronized automatically. The maker describes offline authentication for Windows users without a permanent internet connection. Deployment options include a virtual appliance and containers for Kubernetes and other orchestration platforms. The maker says it can serve small installations through enterprises with thousands of users and distributed setups. The open-source software is listed at free under AGPLv3 and GPLv2; a demo license is also listed at free. LinOTP 3 packages are listed for Debian 10 Buster; RPM packages are currently available only for LinOTP 2.

SuperTokens is an open-source authentication provider for developers adding sign-in and session management to applications. It supports email and password, passwordless email or SMS codes, magic links, social login, and passkeys. Enterprise options include tenant-specific login methods, separate user pools, and enterprise SSO. Developers can adapt the prebuilt interface and add logic before or after API operations with hooks and overrides. Backend SDKs communicate with SuperTokens Core; frontend SDKs call authentication routes exposed by the application backend. Core can be self-hosted, with open-source features free at any scale and no MAU limit. A managed Cloud plan is also available, free under 5K MAUs and then $0.02 per MAU. Other paid or sales-led features include multi-tenancy, cross-domain unified login, machine-to-machine authentication, availability zones with uptime SLAs, and Attack Protection Suite. That suite can detect risky authentication activity and prompt extra verification or block attempts. Integrations include Next.js, NestJS, GraphQL, Capacitor, AWS Lambda, Vercel, Hasura, and Supabase. SuperTokens says it is SOC 2 compliant and describes more than 100 controls and tests.