SuperTokens

SuperTokens adds secure login and session management to an application without handing your user table to somebody else. It is an open-core alternative to proprietary login providers, free with no limit on the number of users, and deployed on premises so the data sits in a database you control.

The design splits into three parts. A frontend SDK renders login widgets and manages session tokens, a backend SDK exposes the sign-up, sign-in, sign-out and refresh APIs your frontend calls, and the SuperTokens Core is an HTTP service holding the auth logic and database operations the backend SDK talks to. The core is Java, shipped with its own JDK in the binary and Docker image, so running it resembles running any other HTTP microservice.

Features are deliberately decoupled, so you can adopt only the pieces you need.

• Login methods: passwordless, social, email password and phone password sign-in.
• Session management: token handling that also integrates with other login providers, including Auth0.
• Multi-factor authentication: a second factor layered onto any of the login methods.
• Multi-tenancy: organization support with enterprise SSO for customers who bring their own identity provider.
• Authorization: user roles alongside authentication between microservices.

Session verification happens inside the backend SDK without contacting the Java core, so one core instance serves tens of thousands of users. SDKs exist for Node.js, Go, Python, React, React Native and vanilla JavaScript, and a dashboard handles user administration. Least vendor lock-in is an explicit goal, and leaving does not force your users to reset passwords or sign up again.