[opensourcedex]

SuperTokens is a free, open source identity & access management (iam) project written in Java and released under a custom open-source licence. It has 15,310 GitHub stars, 841 forks and 155 open issues, and was last pushed 4 days ago. On this registry it ranks #5 of 11 tracked projects in Identity & Access Management (IAM), with 5 head-to-head comparisons available. It gained 12 stars over the last 6 tracked days.

SuperTokens — Secure, customizable authentication for your applications

What is SuperTokens?

What it is

SuperTokens is an open-source authentication and session-management platform for applications that need login, sign-up, sign-out, and user data control. It sits in the identity and access management ecosystem and is described as an alternative to Auth0, Firebase Auth, and AWS Cognito. It separates work into a frontend SDK, a backend SDK, and a Java-based SuperTokens Core service that handles authentication logic and database operations.

The problem it solves is the burden of building authentication from scratch while keeping user experience, developer experience, and security acceptable. Hand-rolled login systems can create security gaps and maintenance cost, and hosted identity services can create vendor lock-in. SuperTokens addresses this by offering an on-premises deployment where the operator controls user data through its own database, while providing login and session management abstractions without requiring manual OAuth implementation.

Key capabilities

  • It provides passwordless login, social login, email-password login, and phone-password login flows.
  • A frontend SDK manages session tokens and renders login UI widgets, while a backend SDK exposes APIs for sign-up, sign-in, sign-out, and session refreshing.
  • It includes multi-factor authentication and user roles for stronger verification and permission grouping.
  • It supports multi-tenancy and organization features for enterprise single sign-on scenarios.
  • It offers microservice authentication for distributed backend access.
  • It lists SDKs for Node.js, Go, Python, React.js, React Native, and Vanilla JS.

Who uses it and how

  • Teams self-host the SuperTokens Core service when they want authentication data inside their own infrastructure and use their own database.
  • Application developers integrate the frontend SDK to add login UI and session-token handling to web or mobile clients.
  • Backend services use the backend SDK to expose authentication APIs for sign-up, sign-in, sign-out, and session refresh.
  • Organizations needing multi-tenancy, roles, or enterprise single sign-on can use the organization and user-role features.
  • Operators who need to inspect or modify the implementation can build the project from source.

Getting started

The typical path is to follow the SuperTokens documentation, choose frontend and backend SDKs, and deploy the SuperTokens Core service on-premises with a database managed by the operator. The project also references building from source for teams that need to run or modify the implementation directly.

When to use it — and when not to

SuperTokens is suitable when a team needs an open-source, self-hosted authentication layer and wants direct control over user data, sessions, login flows, and deployment, rather than relying on Auth0, Firebase Auth, or AWS Cognito. The trade-off is operational responsibility: the self-hoster must run the Core service, connect it to a database, and maintain the authentication stack, and the repository metadata lists the license as NOASSERTION, so licensing terms need separate review. It may be less suitable for teams that want a fully managed identity service with no infrastructure work.

project readme (upstream, from github) — read inline

SuperTokens banner

Open-Source auth provider

chat on Discord Docker pull stats

Add secure login and session management to your apps. SDKs available for popular languages and front-end frameworks e.g. Node.js, Go, Python, React.js, React Native, Vanilla JS, etc.

Architecture Diagram Supertokens architecture is optimized to add secure authentication for your users without compromising on user and developer experience

Three building blocks of SuperTokens architecture

  1. Frontend SDK: Manages session tokens and renders login UI widgets
  2. Backend SDK: Provides APIs for sign-up, sign-in, signout, session refreshing, etc. Your Frontend will talk to these APIs
  3. SuperTokens Core: The HTTP service for the core auth logic and database operations. This service is used by the Backend SDK

Features

Click here to get started

  • Passwordless Login
  • Social Login
  • Email Password Login
  • Phone Password Login
  • Session Management
  • Multi-Factor Authentication
  • Multi Tenancy / Organization Support (Enterprise SSO)
  • User Roles
  • Microservice Authentication

Learn more

If you like our project, please :star2: this repository! For feedback, feel free to join our Discord, or create an issue on this repo

🚀 What is SuperTokens?

SuperTokens is an open-core alternative to proprietary login providers like Auth0 or AWS Cognito. We are different because we offer:

  • Open source: SuperTokens can be used for free, forever, with no limits on the number of users.
  • An on-premises deployment so that you control 100% of your user data, using your own database.
  • An end-to-end solution with login, sign-ups, user and session management, without all the complexities of OAuth protocols.
  • Ease of implementation and higher security.
  • Extensibility: Anyone can contribute and make SuperTokens better!

Philosophy

Authentication directly affects the UX, dev experience, and security of any app. We believe that current solutions cannot optimize for all three "pillars", leading to many applications hand-rolling their own auth. This not only leads to security issues but is also a massive time drain.

We want to change that - we believe the only way is to provide a solution that has the right level of abstraction gives you maximum control, is secure, and is simple to use - just like if you build it yourself, from scratch (minus the time to learn, build, and maintain).

We also believe in the principle of least vendor lock-in. Your having full control of your user's data means that you can switch away from SuperTokens without forcing your existing users to logout, reset their passwords, or in the worst case, sign up again.

Click here to see the demo app.

  • Please visit our website to see the list of features.
  • We want to make features as decoupled as possible. This means you can use SuperTokens for just login, or just session management, or both. In fact, we also offer session management integrations with other login providers like Auth0.

Documentation

The docs can be seen on our website.

There is more information about SuperTokens on the GitHub wiki section.

🏗️ Architecture

Please find an architecture diagram here

For more information, please visit our GitHub wiki section.

☕ Why Java?

  • ✅ Whilst running Java can seem difficult, we provide the JDK along with the binary/docker image when distributing it. This makes running SuperTokens just like running any other HTTP microservice.
  • ✅ Java has a very mature ecosystem. This implies that third-party libraries have been battle-tested.
  • ✅ Java's strong type system ensures fewer bugs and easier maintainability. This is especially important when many people are expected to work on the same project.
  • ✅ Our team is most comfortable with Java and hiring great Java developers is relatively easy as well.
  • ✅ One of the biggest criticisms of Java is memory usage. We have three solutions to this:
    • The most frequent auth-related operation is session verification - this happens within the backend SDK (node, python, Go) without contacting the Java core. Therefore, a single instance of the core can handle several 10s of thousands of users fairly easily.
    • We have carefully chosen our dependencies. For eg: we use an embedded tomcat server instead of a higher-level web framework.
    • We also plan on using GraalVM in the future and this can reduce memory usage by 95%!
  • ✅ If you require any modifications to the auth APIs, those would need to be done on the backend SDK level (for example Node, Golang, Python..). So you’d rarely need to directly modify/work with the Java code in this repo.

⌨️ User Management Dashboard

Oversee your users with the SuperTokens User Management Dashboard

List users

List all the users who have signed up to your application.

List SuperTokens users

Manage users

Manage users by modifying or deleting their sessions, metadata, roles and account info.

Manage users

🔥 SuperTokens vs others

Please find a detailed comparison chart on our website

🛠️ Building from source

Please see our wiki for instructions.

👥 Community

If you think this is a project you could use in the future, please :star2: this repository!

Contributors (across all SuperTokens repositories)


Rishabh Poddar
Advait Ruia
Bhumil Sarvaiya
Joel Coutinho

Rakesh UP<

readme truncated — read the full docs on github

Frequently asked questions

Is SuperTokens free to use?

SuperTokens is open source. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does SuperTokens do?

Secure, customizable authentication for your applications

What is SuperTokens written in?

SuperTokens is primarily written in Java. Its source is publicly available at https://github.com/supertokens/supertokens-core, and it has 15,310 GitHub stars.