SuperTokens is open source user authentication for developers who want to add login, sessions and user management to their own applications while keeping control of the API layer and user data. Teams can self-host it or use it as a managed service.
It suits product teams that would rather not hand their user database to a third-party identity service but also do not want to write authentication from scratch. The project follows an open core model, with a core written in Java and most of the repository under the Apache 2.0 licence.
At A Glance
| Vendor | SuperTokens |
|---|---|
| Category | Open source user authentication |
| Identities covered | Application end users, tenants, services (machine to machine), MCP clients |
| Deployment | Self-hosted (open source) or managed service |
| Agentic AI | MCP Authentication (Beta), guide for AI coding agents |
| Customers | Curology, HackerRank |
| Certifications | SOC 2 |
| Market classification | Workforce IAM |
What SuperTokens Does
Authentication is something almost every application needs and few teams want to build from scratch. With SuperTokens, developers drop in pre-built pieces but run them in their own backend, on their own domain, and can change how each piece behaves.
Functionality is packaged as recipes, extendable building blocks for authentication methods, sessions and user management. The same core runs on the customer’s infrastructure or is hosted by SuperTokens. Either way the customer keeps control of the API layer and its user data, while the pre-built recipes save it from writing login flows, token handling and account screens itself.
Products
Authentication Recipes
Recipes give an application its login options. Teams pick the methods that suit their users and can combine several in one app.
- Email and password, and phone and password
- Passwordless login with OTP or magic links by email or SMS
- Social login and passkeys
- Unified login using OAuth2 across web, mobile and desktop apps
Sessions And User Management
Once a user is signed in, SuperTokens manages the session with cookie or header based tokens, sessions shared across subdomains, session invalidation and access token blacklisting. Support teams can impersonate users to troubleshoot, and anonymous sessions cover visitors who have not signed up yet. Email verification, user roles, account linking and a user management dashboard round it out.
Multi-Factor Authentication
Applications that hold sensitive data add a second factor with email or SMS OTP, TOTP or passkeys, and can ask for step-up authentication before sensitive actions.
Multi-Tenancy And Enterprise SSO
SaaS providers selling to businesses give each customer its own tenant, with tenant specific login methods, an isolated user pool and enterprise SSO including SAML. Plugins handle tenant discovery at sign-in.
Attack Protection Suite
The Attack Protection Suite defends sign-in flows against credential stuffing, bots and other abuse, with plugins for CAPTCHA protection and banning users who misbehave.
Machine To Machine Authentication
Teams running several backend services use this so the services can call each other without sharing a user session. Each service gets access tokens through the OAuth2 client credentials flow, issued and checked by the same core that handles user logins.
How It Works
SuperTokens has three components. The frontend SDK never talks to the authentication service directly; it calls routes exposed by the customer’s own backend.
| Component | What it does |
|---|---|
| Frontend SDK | Manages session tokens and renders the pre-built login UI, hosted on the customer’s domain. |
| Backend SDK | Provides sign up, sign in, sign out and session refresh APIs and talks to the core. |
| SuperTokens Core | An HTTP service written in Java that handles authentication logic and database operations, shipped with the JDK in its binary or Docker image. |
| Deployment | With the managed service, SuperTokens hosts the core. When self-hosted, the core runs inside the customer’s infrastructure and should be reachable only by the backend, never from the public internet. |
Identities And Systems Covered
| End users | People signing in with passwords, passwordless methods, social login or passkeys. |
|---|---|
| Tenants and organisations | Isolated user pools with their own login methods and enterprise SSO. |
| Services | Machine to machine access tokens. |
| MCP servers and clients | Actions on MCP servers that customers build and host. |
Agentic AI Capabilities
MCP Authentication
MCP Authentication protects Model Context Protocol servers that customers build. Because MCP authorisation follows OAuth 2.0, it is built on the OAuth2 recipe. Developers install the supertokens-mcp-plugin package and create a SuperTokensMcpServer, then check each request with claim validators, such as requiring a user role, or with a custom payload validation function. The feature is in Beta, runs on the managed service and supports the node SDK only.
Support For AI Coding Agents
An “Integrate with AI” guide gives AI coding agents the context they need to add SuperTokens to a project. The docs can be opened in ChatGPT, Claude, Cursor and other tools or connected through a documentation MCP server.
Integrations
| Area | Integrations |
|---|---|
| Frameworks and SDKs | More than 25 frameworks, including JS, Go, Python, React, Angular, Vue, Android, Flutter, iOS, NestJS and Next.js |
| Hosting and serverless | AWS Lambda, Netlify, Vercel, Docker |
| Data and API platforms | GraphQL, Hasura, Supabase |
Company Background
| Founded | 2019, joining Y Combinator in summer 2020. |
|---|---|
| Headquarters | San Francisco, United States. |
| Leadership | Advait Ruia, CEO. |
| Funding | Backed by Y Combinator (including Continuity), Root Ventures and WestWave, with a further venture round in December 2023. |
Note: This overview is compiled from SuperTokens’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.