SuperTokens

SuperTokens is an open-core authentication provider for adding login, session management, and multi-factor authentication to an application, built as a self-hosted alternative to Auth0, Firebase Authentication, and AWS Cognito. It splits into a frontend SDK, a backend SDK, and a core HTTP service, so teams get prebuilt login UI and API endpoints without handing user data to a third party. SDKs cover Node.js, Go, Python, React, React Native, and vanilla JavaScript, and the project frames its goal as offering the control of building auth yourself without the time cost of actually doing so.

Key features

• Multiple login methods: passwordless, social login, email-password, and phone-password authentication are all supported out of the box.
• Session management: the frontend and backend SDKs handle session token issuance, refreshing, and revocation without custom token logic.
• Multi-factor authentication: add a second factor to any of the supported login methods.
• Multi-tenancy and enterprise SSO: support multiple organizations or tenants, including SAML-based enterprise SSO, within one deployment.
• User roles: assign and check roles for access control across the application.
• User management dashboard: view and manage users, sessions, metadata, and roles from a built-in admin dashboard rather than querying the database directly.
• Microservice authentication: secure service-to-service calls using the same session infrastructure as end-user login.
• Session management for other providers: SuperTokens can also handle session management alongside other login providers, including Auth0, for teams migrating incrementally.

Self-hosting and deployment

The SuperTokens Core runs as a Java-based HTTP service backed by your own database, deployed via a Docker image (with separate images for PostgreSQL and MySQL backends) or built from source following the project's wiki instructions. Because session verification happens in the backend SDK without contacting the core service on every request, a single core instance can handle tens of thousands of users fairly easily, according to the project. A hosted managed service is also available for teams that don't want to run the core themselves.

Why Java for the core

The project explains its choice of Java as a deliberate tradeoff: the JDK ships bundled with the binary or Docker image so running SuperTokens feels like running any other HTTP microservice, the ecosystem is mature and well tested, and the type system reduces bugs on a codebase many contributors touch. Memory usage, historically a criticism of Java services, is mitigated because session verification avoids the core entirely and because the core uses an embedded Tomcat server rather than a heavier web framework.

Learn more

Additional architecture detail, including diagrams for self-hosted and managed deployments, is documented in the project's GitHub wiki, alongside a live demo app for testing the third-party and email-password login flow before integrating it.

Tech stack

The core service is written in Java, with an Apache 2.0 license covering everything outside the separately licensed ee/ directory, and Docker pull statistics for the official images are tracked publicly on Docker Hub.