Open-source authentication with a self-hostable Core SuperTokens is open-source user authentication built around a self-hostable Core service plus frontend and backend SDKs. It covers email/password login, passwordless OTP and magic links, social login, single sign-on, multi-factor authentication, and session management, and you can run the Core in your own infrastructure or pay for the managed Cloud service.[1][2][3]
Quick verdict
Open-source auth for teams that want data control SuperTokens suits teams that want open-source authentication they can self-host without giving up passwordless, social login, SSO, and MFA. The Core is genuinely Apache-2.0 and the migration docs ease exits from hosted providers, but self-hosting is real operational work and the managed Cloud turns usage-based past 5,000 MAU. Confirm support terms with sales if an SLA matters.[1][2][3][4]
Capabilities
Core plus SDK session model The SuperTokens Core provides the authentication functionality while backend SDKs talk to it and frontend SDKs call auth routes on your own backend. The frontend never contacts the Core directly, so the API layer and login behavior stay under application control.[1]
Password, passwordless, and social login Recipes cover email/password signup and sign-in with verification and password reset, passwordless one-time passwords and magic links over email or SMS, username and phone-number variants, and social login with Google, Apple, GitHub, and custom providers.[1][2]
SSO, multitenancy, and account linking Documented recipes include single sign-on, multi-tenancy for B2B-style tenant isolation, and account linking, alongside a newer attack protection suite for risky authentication activity.[1][2]
Multi-factor and step-up options Additional verification supports email or SMS OTP, TOTP, and passkeys as factors, with step-up authentication for sensitive actions.[1]
Documented legacy migration path Migration guides split a provider switch into account migration for users and credentials and session migration for active sessions, so a team can move off a legacy provider without forcing every user to re-authenticate at once.[1]
Good fit
Data control without building auth Teams that must keep user credentials and sessions in their own infrastructure get a documented Docker or binary deployment against their own PostgreSQL, instead of handing the user store to a third-party cloud.[1][2]
Full login menu from one provider Products that need passwordless, social login, SSO, and MFA together can adopt them as composable recipes rather than integrating a separate service for each method.[1][2]
Planned exits from hosted auth Teams planning to leave a hosted provider such as Auth0 benefit from explicit migration documentation and positioning as an open source replacement, which lowers the research burden of the switch.[1][2]
Limitations
You operate the infrastructure Self-hosting means running and hardening the Core and PostgreSQL yourself: private networking, API keys, TLS at a proxy, and tenant isolation enforced by your backend. That is real operational work, not a toggle.[1]
PostgreSQL only on current Core Core 11.0.0 dropped MySQL and MongoDB support, so the supported persistent store is PostgreSQL, with an in-memory database reserved for testing.[1]
Cloud bill scales with active users The free Cloud allowance ends at 5,000 monthly active users, after which usage-based per-MAU pricing applies, so a growing consumer app should model that curve against the cost of self-hosting.[1]
Enterprise terms need a sales call Support plan terms and enterprise specifics were not verified in public sources; the site routes enterprise and consultancy interest through contact sales, so teams needing an SLA should confirm it directly.[1][2]
Compatibility
SDKs across web and mobile Frontend and backend SDKs with prebuilt login UI cover web and mobile applications, and the docs address web, mobile, and desktop through unified OAuth2 login.[1][2]
Standards-based integration points Unified login exposes a common OAuth2 provider across applications, and machine-to-machine authentication uses the OAuth2 client credentials flow for service-to-service requests.[1]
Apache-2.0 core for embedding The Core under Apache License 2.0 can be embedded in commercial deployments under that license terms, which suits vendors that ship authentication inside their own product.[1]
Questions worth asking
Is SuperTokens really open source?
The SuperTokens Core repository is licensed under Apache 2.0, and the vendor states that self-hosting the open source features is free without limits. The managed Cloud service and extended features are paid, so treat it as open-core: a free open core with commercial hosting and editions around it.[1][2]
How much does managed SuperTokens cost?
Managed Cloud costs $0.02 per monthly active user and is free under 5,000 MAU. Self-hosting the open source features on your own infrastructure is free without a MAU limit. Check the current pricing page before budgeting, since plan details can change.[1]
Can I migrate to SuperTokens from Auth0 or another provider?
The docs describe a two-step migration: account migration imports users and credentials from the legacy provider, and session migration carries over active sessions so logged-in users are not interrupted. The repository explicitly positions SuperTokens as an open source alternative to Auth0, Firebase Auth, and AWS Cognito.[1]
What do I need to run SuperTokens myself?
You deploy the Core with its Docker image or a binary on Linux, macOS, or Windows, backed by PostgreSQL, with the Core listening on port 3567. Keep the Core and database on a private network reachable only by your backend, and configure an API key, since there is none by default.[1]
Sources and editorial review
Source research. Reviewed on October 13, 2026. Written by Sanjib Sah. AI assisted; reviewed by a human editor.
We have not run or tested this product.
- SuperTokens homepage
official · Observed October 12, 2026
Official homepage headlines Open Source User Authentication, setup in 5 minutes with prebuilt UI, frontend and backend SDK snippets, SSO/multi-tenancy/account-linking features, and Y Combinator backing.
- supertokens-core repository
official · Observed October 12, 2026
supertokens/supertokens-core describes itself as an open source alternative to Auth0, Firebase Auth, and AWS Cognito; the README states the Core is written in Java and ships the JDK with the binary and Docker image.
- supertokens-core license
official · Observed October 12, 2026
LICENSE.md in supertokens-core is the Apache License, Version 2.0, with copyright 2020-2023 SuperTokens, Inc.
- SuperTokens pricing
official · Observed October 12, 2026
Pricing offers Cloud at $0.02 per MAU free under 5,000 MAU and self-hosting the open source features free without limits, with SSO providers including Google, GitHub, Facebook, and custom providers.
- SuperTokens documentation introduction
official · Observed October 12, 2026
Docs introduction presents a self-hostable Core plus managed service with recipe building blocks: email/password, passwordless, social login, passkeys, unified OAuth2 login, M2M auth, MFA, attack protection, and enterprise login with multitenancy.
- SuperTokens migration overview
official · Observed October 12, 2026
Migration overview documents moving from a legacy provider in two steps, account migration and session migration, executed against CORE_API_ENDPOINT with an API key.
- SuperTokens self-hosting guide
official · Observed October 12, 2026
Self-host guide deploys the Core with Docker or a VM binary backed by PostgreSQL on port 3567, with API-key and private-network hardening; MySQL and MongoDB were dropped in Core 11.0.0.