SuperTokens
Open-source self-hosted auth library. SDK-style integration, app-database-aware.
VISIT SUPERTOKENSKey takeaway: Think of this as a self-hosted auth library rather than an identity provider. Auth state lives in the same database as your application data, which keeps joins simple and avoids operating a separate identity system. For enterprise SSO at scale it is the wrong shape, and Keycloak or Authentik should take that job instead.
Quick facts
- CategorySelf-hosted
- LanguageTypeScript
- PricingOpen source
- LicenseApache-2.0
- Created2020
- GitHub stars14.6k
- HIPAA-eligibleNo
- SSO / SAMLOut of box
What it is
SuperTokens is open-source auth designed for self-hosting in the same database your app uses. SDK + core service, multiple recipes (email-password, passwordless, social, MFA). Lighter than Keycloak, integrates more like a library than a separate IDP.
Best for
- Apps that want auth state in the same database as application data
- Self-hosted needs without IDP-level complexity
- TypeScript / Node teams
When not to pick it
Skip SuperTokens for enterprise SSO at scale, Keycloak / Authentik fit that brief better. Skip if your team prefers SaaS auth.
My take
SuperTokens is good for self-hosted auth at the small-to-mid scale. The same-database story is genuinely useful.
Recipes and the same-database story
SuperTokens is organised around recipes: email and password, passwordless, third-party social login, session management, MFA and multi-tenancy, each enabled independently so you carry only what you use. You run a core service that talks to your database, plus backend and frontend SDKs that sit inside your application. Because the user tables live in your database rather than a vendor's, you can join a user to their orders in one query, back everything up together, and reason about the whole system without an API call in the middle. The session implementation deserves a mention: rotating refresh tokens with detection of stolen tokens is a thoughtful default most teams would never build themselves. The core service is still a component to deploy, monitor and upgrade, so this is not zero operations, but it is much closer to a dependency than to standing up an identity provider.
Where it stops, and the Better Auth comparison
Two limits are worth knowing before you commit. First, this is not an enterprise identity provider. SAML login exists, but multi-tenant SAML across many corporate customers, LDAP federation, and the administration surfaces enterprises expect are not what SuperTokens leads on, and Keycloak or Authentik cover that brief properly. Second, you build the UI. Pre-built components exist and get you to a working sign-in quickly, but they are functional rather than beautiful, and most teams end up customising or replacing them. The interesting comparison is Better Auth, which occupies similar territory as a TypeScript library with no separate core service to run. SuperTokens gives you a language-agnostic core with backend SDKs beyond Node. Better Auth gives you fewer moving parts if your entire backend is TypeScript. Pick on that axis and the decision is straightforward.
Frequently asked questions
Is SuperTokens free?
The self-hosted version is open source under Apache 2.0 and free with no user limits. There is a managed cloud and paid tiers for some advanced capabilities, so check whether the specific feature you need, such as certain multi-tenancy or account-linking behaviour, sits in the free self-hosted tier before you design your architecture around it.
SuperTokens or Better Auth?
Better Auth if your backend is entirely TypeScript and you want no separate service to deploy. SuperTokens if you want a language-agnostic core with backend SDKs beyond Node, or you prefer auth running as its own process against your database. Both keep the user table in your own database, which is the reason to consider either one.
Does SuperTokens support enterprise SSO?
SAML login and multi-tenancy are both supported, so basic enterprise SSO is achievable, though some tenancy behaviour is plan-dependent. It is not where the product is strongest. If enterprise identity is central to your business, WorkOS for hosted, or Keycloak and Authentik for self-hosted, will handle directory sync, per-tenant configuration and audit expectations considerably better.
Links
Similar tools you should also consider
Authentik
Modern open-source self-hosted IDP. Python-based, lighter than Keycloak.
Read the take →FusionAuth
Self-hosted auth from a US team. Lighter than Keycloak, paid for support, free for self-hosting.
Read the take →Better Auth
Newer TypeScript-first OSS auth library. Designed as the modern Auth.js alternative.
Read the take →If SuperTokens is your pick, the next conversation is short
The 30-min call is where your auth choice becomes a real architecture, a migration plan if you are switching, and a price range you can take to your stakeholders. Describe your stack, your scale, your compliance constraints. I tell you whether SuperTokens is genuinely your fit.