SuperTokens

What is SuperTokens?

SuperTokens is an open source user authentication platform that lets developers add login, session management and access control to their applications while keeping control of their own data and infrastructure. SuperTokens differentiates itself through a modular, self-hosted architecture that runs on the developer's own domain without redirects, backed by Y Combinator and a 12K+ star GitHub project.

Key Features

• Prebuilt and custom UI options: SuperTokens ships with prebuilt login screens that can be set up in about five minutes, or developers can use frontend SDKs and helper functions to build their own login pages. Authentication is hosted on the developer's own domain, so users are not redirected to a third-party service.
• Modular recipe architecture: Frontend and backend configuration is composed from "recipes" such as EmailPassword.init() and SessionReact.init() on the frontend, with matching Node recipes on the backend. This lets teams enable only the authentication methods they need and tailor the flow to their requirements.
• Session management controls: SuperTokens supports configurable session policies, including limiting the number of active sessions and detecting multiple simultaneous logins, with the option to force logout from other sessions.
• Custom password policies: Developers can define password rules such as requiring at least one capital letter, one special character and one number, enforced directly in the sign-up flow.
• Authentication plugins: Optional plugins extend core auth, including Captcha Protection (supporting reCAPTCHAv3, reCAPTCHAv2 or turnstile) to block bots and brute-force attempts, User Banning for administrators to ban or unban users, and Tenant Discovery for multi-tenant user selection integrated with the backend tenant discovery plugin.
• Broad framework and platform support: SuperTokens works with 25+ frameworks and platforms, including JavaScript, Go, Python, React, Angular, Vue, Android, Flutter and iOS.
• Multiple authentication methods: Guides cover email password login, passwordless login and social login, so teams can mix authentication methods within one system.

Use Cases

• Startups shipping authentication quickly: Teams can start from a prebuilt UI and be running in about five minutes, then customize the login experience as requirements grow.
• Enterprises with data residency or control requirements: Because SuperTokens is open source and hosted on the developer's own domain, organizations that need to maintain control over authentication infrastructure can self-host rather than redirect users to a vendor.
• Multi-tenant SaaS applications: The Tenant Discovery plugin gives users an interface to select tenants, integrated with backend tenant discovery, which suits products serving multiple organizations.
• Security-conscious login flows: Teams facing bot traffic or brute-force attempts can add Captcha Protection, and administrators can manage abusive accounts through the User Banning plugin.
• Cross-platform products: Teams building web, mobile and native apps across React, Angular, Vue, Android, Flutter and iOS can use one authentication system across all of them.

Who It Is For

SuperTokens is aimed at developers and engineering teams—from startups to enterprises—who need to add authentication to their applications without handing control of user data to a third-party service. It suits frontend and backend developers working across JavaScript, Go, Python, React, Angular, Vue, Android, Flutter and iOS who want prebuilt login flows for speed but need the flexibility to customize sessions, password policies and plugins as their requirements evolve.

Pricing

SuperTokens describes its pricing as reasonable and positions cost reduction as a core benefit alongside building fast and maintaining control. Specific plan details and price figures are not stated in the source material.

Frequently Asked Questions

What is SuperTokens used for?

SuperTokens is used to add user authentication to applications, including email password login, passwordless login and social login, along with session management, custom password policies and plugins such as Captcha Protection and User Banning.

Is SuperTokens open source?

Yes. SuperTokens is an open source user authentication platform, with a GitHub project that has more than 12K stars, and it is backed by Y Combinator.

Which frameworks and languages does SuperTokens support?

SuperTokens works with 25+ frameworks and platforms, including JavaScript, Go, Python, React, Angular, Vue, Android, Flutter and iOS.

Does SuperTokens redirect users to a third-party domain?

No. SuperTokens authentication is hosted on the developer's own domain, so there are no redirects away from the application during login.

Who should use SuperTokens?

SuperTokens is intended for developers and teams that want to build authentication quickly while maintaining control of their infrastructure and data, from startups needing a fast setup to enterprises with multi-tenant or security requirements.