Supertokens architecture is optimized to add secure authentication for your users without compromising on user and
developer experience
15.3K ·GitHub
What is this?
SuperTokens is an open-source auth provider for adding secure login and session management to your apps — an open-core alternative to proprietary providers like Auth0, Firebase Auth and AWS Cognito.
SuperTokens is an open-source auth provider for adding secure login and session management to your apps — an open-core alternative to proprietary providers like Auth0, Firebase Auth and AWS Cognito.Is this repo the whole auth system, or just one part of it?Just one part: this is the SuperTokens Core, the HTTP service holding the core auth logic and database operations. A full setup also uses a frontend SDK and a backend SDK that talk to this service.
Just one part: this is the SuperTokens Core, the HTTP service holding the core auth logic and database operations. A full setup also uses a frontend SDK and a backend SDK that talk to this service.How do I get it running?Download the binary or Docker image — the JDK is bundled with the distribution — and run it like any other HTTP microservice. Building from source is covered on the project wiki.
Download the binary or Docker image — the JDK is bundled with the distribution — and run it like any other HTTP microservice. Building from source is covered on the project wiki.What do I add to my app to connect to it?A backend SDK (Node.js, Go, Python, and more) plus a frontend SDK (React.js, React Native, Vanilla JS, and more) — the frontend handles session tokens and the login UI, the backend talks to the core.
A backend SDK (Node.js, Go, Python, and more) plus a frontend SDK (React.js, React Native, Vanilla JS, and more) — the frontend handles session tokens and the login UI, the backend talks to the core.Is it really free to use, or is there a catch?The core is free forever with no limits on the number of users. It is an open-core project, so enterprise extras like Enterprise SSO exist on top, but the service itself costs nothing.
The core is free forever with no limits on the number of users. It is an open-core project, so enterprise extras like Enterprise SSO exist on top, but the service itself costs nothing.Where does my users' data end up?On your own infrastructure: the core is deployed on-premises with your own database, so you keep 100% control of user data and can switch away without forcing users to log out or sign up again.
On your own infrastructure: the core is deployed on-premises with your own database, so you keep 100% control of user data and can switch away without forcing users to log out or sign up again.Which login methods does it support out of the box?Passwordless, social login, email-password, phone-password, plus session management, multi-factor authentication, multi-tenancy with Enterprise SSO, user roles, and microservice authentication.
Passwordless, social login, email-password, phone-password, plus session management, multi-factor authentication, multi-tenancy with Enterprise SSO, user roles, and microservice authentication.Why is the core written in Java, and will it be heavy?The team chose Java for its mature ecosystem and strong type system, and the JDK ships with the binary so you never manage it. Memory stays low because session verification runs in the backend SDKs without contacting the core — one instance handles several tens of thousands of users — and GraalVM support is planned to cut memory usage by 95%.
The team chose Java for its mature ecosystem and strong type system, and the JDK ships with the binary so you never manage it. Memory stays low because session verification runs in the backend SDKs without contacting the core — one instance handles several tens of thousands of users — and GraalVM support is planned to cut memory usage by 95%.Can I manage signed-up users somewhere?Yes — the User Management Dashboard lets you list all users who signed up to your application and manage them by modifying or deleting their sessions, metadata, roles and account info.
Yes — the User Management Dashboard lets you list all users who signed up to your application and manage them by modifying or deleting their sessions, metadata, roles and account info.Do I have to replace my entire auth stack to try it?No. Features are deliberately decoupled: you can use just login, just session management, or both — and SuperTokens even offers session management integrations alongside other login providers like Auth0.
No. Features are deliberately decoupled: you can use just login, just session management, or both — and SuperTokens even offers session management integrations alongside other login providers like Auth0.What are similar projects?logto, casdoor, django-allauth, zitadel, Sa-Token, kratos, keycloak, casbin
logto, casdoor, django-allauth, zitadel, Sa-Token, kratos, keycloak, casbinWhich topics is it in?session-management, mfa, login, password, auth, sso, oauth, authentication, java, hacktoberfest, backend, privacy
session-management, mfa, login, password, auth, sso, oauth, authentication, java, hacktoberfest, backend, privacy