Freedom251 › Multi-Factor Authentication APIs
SuperTokens
What SuperTokens is
SuperTokens is an open-source authentication provider for developers building applications that need sign-in and session management. It supports email and password, passwordless email or SMS one-time codes, magic links, social login, and passkeys. Enterprise authentication options include tenant-specific login methods, separate user pools, and enterprise SSO. Developers can tailor the prebuilt interface and add logic before or after API operations using hooks and overrides.
Backend SDKs connect to SuperTokens Core, while frontend SDKs send requests to authentication routes provided by the application backend. The Core can run as a self-hosted service. Its open-source features are free at any scale, with no MAU limit; a managed Cloud plan is also available and is free under 5K MAUs, then billed at $0.02 per MAU. Listed integrations include Next.js, NestJS, GraphQL, RedwoodJS, Capacitor, AWS Lambda, Netlify, Vercel, Hasura, and Supabase. The product also offers paid options such as multi-tenancy, cross-domain unified login, machine-to-machine authentication, availability zones with uptime SLAs, and an Attack Protection Suite. The company states that SuperTokens is SOC 2 compliant and describes more than 100 controls and tests.
Who it suits
SuperTokens suits developers who want to add customizable authentication and session handling to an application, whether they run its Core themselves or use the managed Cloud plan. Its range of login methods, enterprise options, and integrations also fits teams building for startups or enterprises.
What it does well
- Open-source features are free at any scale with no MAU limit.
- Supports passwords, OTPs, magic links, social login, and passkeys.
- Developers can tailor the prebuilt UI and API logic.
- Core can be self-hosted.
- Integrations include Next.js, NestJS, Vercel, Hasura, and Supabase.
What to know first
- The MFA add-on has a $100 minimum monthly bill.
- The Account Linking add-on has a $100 minimum monthly bill.
- Some features, including multi-tenancy and Attack Protection, are paid or contact-sales options.
Limits
The self-hosted open-source features have no MAU limit. Cloud is free under 5K MAUs and billed at $0.02 per MAU; the MFA and Account Linking add-ons each have a $100 minimum monthly bill.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Self-hosted open source | Free at any scale for open source features · Open source features · no MAU limit · paid add-ons available | Free |
| Self-hosted | Open-source features free at any scale · paid add-ons available · customer operates infrastructure | Free |
| Multi-factor authentication add-on | $0.01 / MAU; Minimum Billing of $100 / month · MFA add-on · $100 minimum monthly billing | $0.01 a month |
| Account Linking add-on | $0.005 / MAU · Minimum Billing of $100 / month | $0.01 a month |
| Cloud | per monthly active user (MAU); free under 5,000 MAUs · Core authentication and session features · paid add-ons · $100 monthly minimum for MFA or account linking | $0.02 a month |
| Dashboard users | $20 / user / month · 3 free users | $20 a month |
As supertokens.com lists them, read 30 Sept 2026. The maker's own page has the final word.
Getting started
- Visit the SuperTokens website.
- Choose whether to use the self-hosted Core or managed Cloud.
- Select a backend SDK and connect it to SuperTokens Core.
- Use a frontend SDK to send requests to authentication routes in your application backend.
- Adapt the prebuilt UI or add API logic with hooks and overrides.
Verdict
Choose SuperTokens if you need customizable authentication and want the option to self-host its Core or use managed Cloud. Check the paid add-on terms if you need MFA or account linking, since each has a $100 minimum monthly bill.
Questions
Is SuperTokens free?
Its self-hosted open-source features are free at any scale with no MAU limit. The Cloud plan is free under 5K MAUs.
How much does SuperTokens cost?
The listed paid-from price is $0.02/user/mo. The Cloud plan is billed at $0.02 per MAU, and add-on pricing includes minimum monthly bills.
Can I self-host SuperTokens?
Yes. SuperTokens Core can be self-hosted, and its open-source features are free at any scale.
What authentication methods does it support?
It supports email and password, email or SMS OTP, magic links, social login, and passkeys.
What platforms does SuperTokens support?
Listed platforms are Android, API, iOS, self-hosted, and web.
Does SuperTokens offer enterprise authentication?
Yes. It offers tenant-specific login methods, isolated user pools, and enterprise SSO.
Facts from SuperTokens's own pages
- API and extensibility
- Backend SDKs expose sign-up, sign-in, sign-out, session-refresh, and related authentication APIs, while recipes provide composable extension points. · github.com, 15 Oct 2026
- Architecture
- The frontend SDK talks to the application backend, which communicates with SuperTokens Core; the frontend does not call Core directly. · supertokens.com, 15 Oct 2026
- Attack protection
- The Attack Protection Suite detects risky authentication activity and can trigger extra verification or block attempts; its documentation marks the feature beta and disabled by default. · supertokens.com, 15 Oct 2026
- Authentication methods
- The platform supports email/password, passwordless magic links or OTPs, social login, passkeys, MFA, unified login, machine-to-machine authentication, and enterprise multitenancy. · supertokens.com, 15 Oct 2026
- Company founding
- Crunchbase lists the company as founded in 2019. · crunchbase.com, 15 Oct 2026
- Company legal name and founders
- Crunchbase identifies the legal name as SuperTokens, Inc. and lists Advait Ruia and Rishabh Poddar as co-founders. · crunchbase.com, 15 Oct 2026
- Company LinkedIn profile
- LinkedIn lists SuperTokens as a privately held software-development company headquartered in San Francisco with 2–10 employees. · linkedin.com, 15 Oct 2026
- Company milestone
- The company’s own history says it entered Y Combinator in summer 2020 and raised additional venture capital in December 2023. · supertokens.com, 15 Oct 2026
- Compliance
- The pricing page lists SOC 2 compliance among the core features. · supertokens.com, 15 Oct 2026
- Customization
- Prebuilt UI components can be customized, and hooks or overrides can add logic before or after authentication APIs. · supertokens.com, 15 Oct 2026
- Deployment tooling
- The independent developer guide lists official Docker images and Kubernetes deployment as supported self-hosting approaches. · zairalabs.ai, 15 Oct 2026
- Documentation
- The documentation includes quickstarts, migration guidance, integration guides, API references, security material, and deployment instructions. · supertokens.com, 15 Oct 2026
- Email and password
- Email/password authentication includes customizable forms, email verification, and password-reset flows. · supertokens.com, 15 Oct 2026
- Enterprise and multitenancy
- Enterprise login supports tenant-specific login methods, isolated user pools, and enterprise SSO. · supertokens.com, 15 Oct 2026
- Enterprise authentication
- It offers tenant-specific login methods, isolated user pools, and enterprise SSO. · supertokens.com, 30 Sept 2026
- Founded
- 2019 · supertokens.com, 28 Sept 2026
- Funding
- Crunchbase lists four seed funding rounds and investors including WestWave Capital and Irregular Expressions, but the displayed dollar amounts are obscured. · crunchbase.com, 15 Oct 2026
- Integrations
- The homepage lists support for JavaScript, Go, Python, React, Angular, Vue, Android, Flutter, and iOS, and says it works with more than 25 frameworks. · supertokens.com, 15 Oct 2026
- Intended users
- The company describes its product as an open-source user authentication provider for developers and says it serves startups and enterprises. · supertokens.com, 30 Sept 2026
- Licence
- The public portions of SuperTokens Core are licensed under Apache 2.0, while the ee directory is governed by a separate enterprise licence. · github.com, 15 Oct 2026
- Limit: enterprise IAM
- An independent review says SuperTokens is a weaker fit when an organization needs broad enterprise IAM such as LDAP or advanced SSO governance. · gautamkhorana.com, 15 Oct 2026
- Limit: G2 reviewer complaint
- The G2 reviewer said caching for higher performance was not supported. · g2.com, 15 Oct 2026
- Limit: Gartner reviewer
- The Gartner reviewer said the default UI has limited customization for a specific brand. · gartner.com, 15 Oct 2026
- Limit: operations
- An independent guide says self-hosting adds a stateful service, database management, monitoring, backups, schema versioning, and another failure domain. · zairalabs.ai, 15 Oct 2026