- Home
- Multi-Factor Authentication APIs
- SuperTokens
SuperTokens
What it is
SuperTokens is an open-source authentication provider for developers adding sign-in and session management to applications. It supports email and password, social login, passkeys, and passwordless options including magic links and email or SMS one-time codes. Developers can customize its prebuilt interface and add logic before or after API operations using hooks and overrides. Backend SDKs communicate with SuperTokens Core, while frontend SDKs make requests to authentication routes exposed by the application backend. The Core can be self-hosted, with open-source features free at any scale and no MAU limit. The managed Cloud plan is free under 5K MAUs and costs $0.02 per MAU. Enterprise capabilities include tenant-specific login methods, isolated user pools, and enterprise SSO; several features, including multi-tenancy and Attack Protection Suite, are paid or available by contacting sales. Integrations documentation lists frameworks and services such as Next.js, NestJS, GraphQL, Vercel, Hasura, and Supabase. The company describes SuperTokens as SOC 2 compliant and says it has more than 100 controls and tests.
For and against
For
- Open-source features are free at any scale.
- Supports passkeys, social login, and passwordless methods.
- Prebuilt UI can be customized with hooks and overrides.
- Integrations include Next.js, NestJS, and Supabase.
Against
- Cloud is billed at $0.02 per MAU.
- MFA add-on has a $100 monthly minimum.
- Several enterprise features are paid or contact-sales.
The verdict
SuperTokens offers application authentication with multiple sign-in methods and customizable interfaces. Teams should weigh the free self-hosted option against paid Cloud and add-on costs.
Who it suits
It suits developers building authentication into applications, from startups to enterprises. Self-hosting is an option for teams that want to run SuperTokens Core themselves.
Plans and prices
Self-hosted
Open-source features free at any scale · paid add-ons available · customer operates infrastructure
Read 15 Oct 2026 · supertokens.com
Cloud
Core authentication and session features · paid add-ons · $100 monthly minimum for MFA or account linking
Read 15 Oct 2026 · supertokens.com
Self-hosted open source
Open source features · no MAU limit · paid add-ons available
Read 30 Sep 2026 · supertokens.com
Account Linking add-on
Minimum Billing of $100 / month
Read 30 Sep 2026 · supertokens.com
Multi-factor authentication add-on
MFA add-on · $100 minimum monthly billing
Read 30 Sep 2026 · supertokens.com
Dashboard users
3 free users
Read 30 Sep 2026 · supertokens.com
On the record
- API and extensibility
- Backend SDKs expose sign-up, sign-in, sign-out, session-refresh, and related authentication APIs, while recipes provide composable extension points.github.com · read 15 Oct 2026
- Architecture
- The frontend SDK talks to the application backend, which communicates with SuperTokens Core; the frontend does not call Core directly.supertokens.com · read 15 Oct 2026
- Attack protection
- The Attack Protection Suite detects risky authentication activity and can trigger extra verification or block attempts; its documentation marks the feature beta and disabled by default.supertokens.com · read 15 Oct 2026
- Authentication methods
- The platform supports email/password, passwordless magic links or OTPs, social login, passkeys, MFA, unified login, machine-to-machine authentication, and enterprise multitenancy.supertokens.com · read 15 Oct 2026
- Company founding
- Crunchbase lists the company as founded in 2019.crunchbase.com · read 15 Oct 2026
- Company legal name and founders
- Crunchbase identifies the legal name as SuperTokens, Inc. and lists Advait Ruia and Rishabh Poddar as co-founders.crunchbase.com · read 15 Oct 2026
- Company LinkedIn profile
- LinkedIn lists SuperTokens as a privately held software-development company headquartered in San Francisco with 2–10 employees.linkedin.com · read 15 Oct 2026
- Company milestone
- The company’s own history says it entered Y Combinator in summer 2020 and raised additional venture capital in December 2023.supertokens.com · read 15 Oct 2026
- Compliance
- The pricing page lists SOC 2 compliance among the core features.supertokens.com · read 15 Oct 2026
- Customization
- Prebuilt UI components can be customized, and hooks or overrides can add logic before or after authentication APIs.supertokens.com · read 15 Oct 2026
- Deployment tooling
- The independent developer guide lists official Docker images and Kubernetes deployment as supported self-hosting approaches.zairalabs.ai · read 15 Oct 2026
- Documentation
- The documentation includes quickstarts, migration guidance, integration guides, API references, security material, and deployment instructions.supertokens.com · read 15 Oct 2026
- Email and password
- Email/password authentication includes customizable forms, email verification, and password-reset flows.supertokens.com · read 15 Oct 2026
- Enterprise and multitenancy
- Enterprise login supports tenant-specific login methods, isolated user pools, and enterprise SSO.supertokens.com · read 15 Oct 2026
- Enterprise authentication
- It offers tenant-specific login methods, isolated user pools, and enterprise SSO.supertokens.com · read 30 Sep 2026
- Funding
- Crunchbase lists four seed funding rounds and investors including WestWave Capital and Irregular Expressions, but the displayed dollar amounts are obscured.crunchbase.com · read 15 Oct 2026
- Integrations
- The homepage lists support for JavaScript, Go, Python, React, Angular, Vue, Android, Flutter, and iOS, and says it works with more than 25 frameworks.supertokens.com · read 15 Oct 2026
- Intended users
- The company describes its product as an open-source user authentication provider for developers and says it serves startups and enterprises.supertokens.com · read 30 Sep 2026
