SuperTokens
SuperTokens is an open-source user authentication platform offering self-hosted and managed alternatives to Auth0 and Okta, serving developers and engineering teams at startups and enterprises with modular authentication recipes across 25+ frameworks.
- Company typePrivate
- Founded2019
- HeadquartersSan Francisco, United States
- Headcount11–50
- GTM typeB2B
- OfferingSoftware
What SuperTokens does
SuperTokens is a privately held, Y Combinator-backed open-source user authentication platform founded in 2019 by Advait Ruia (CEO) and Rishabh Poddar (Ex-CTO). The company provides a modular, recipe-based authentication architecture positioned as an alternative to Auth0, Okta, Firebase Auth, and AWS Cognito, with both self-hosted (SuperTokens Core) and managed SaaS deployment options. The platform supports 25+ frameworks across frontend (React, Angular, Vue, React Native) and backend (Node.js, Python, Go), and exposes authentication recipes for email/password, passwordless (OTP and magic link), social login, and passkeys, plus enterprise features including SSO (SAML/OIDC), multi-tenancy, account linking, machine-to-machine authentication, and a unified login flow across multiple domains.
The technology foundation centers on rotating refresh tokens with short-lived access tokens and parent-child token hierarchies for token theft detection, cookie-based session management (cited as unique versus Auth0/Okta/Cognito), and a plugin architecture for CAPTCHA protection, user banning, and tenant discovery. Recent 2024 additions include an Attack Protection Suite, Passkeys (WebAuthn), M2M OAuth2 client credentials, and a Model Context Protocol (MCP) server enabling AI agent administration. The company holds SOC 2 Type II and GDPR certifications with data residency in US, EU, and Australia.
SuperTokens monetizes through a freemium model: the open-source core is free forever with self-hosting; the managed service is free up to 5,000 MAUs then $0.02/MAU; paid add-ons include MFA, multi-tenancy, and account linking; and enterprise contracts provide SLAs, dedicated support, custom SLAs, and migration consulting. Go-to-market combines community-led growth via Discord (15-minute response times), product-led growth through the free tier, and enterprise field sales for larger accounts with Auth0 migration services. The company is headquartered in San Francisco, has 11-50 employees, and reports 12K+ GitHub stars, with named customers spanning Curology, Stacker, Qloo, Traceable.ai, and Flightcontrol.
SuperTokens firmographics
Firmographics- Name
- SuperTokens
- Legal name
- SuperTokens
- Website
- https://supertokens.com
- Company type
- Private
- Founded year
- 2019
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- SuperTokens is an open-source user authentication platform offering self-hosted and managed alternatives to Auth0 and Okta, serving developers and engineering teams at startups and enterprises with modular authentication recipes across 25+ frameworks.
- Ownership category
- akta.pro rank
SuperTokens industry classification
Industry- Product category
- Identity and Access Management
- NAICS
- Computer Systems Design and Related Services (5415)
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- Single Sign-On (SSO) & Federation (SAML/OIDC, Identity Providers) (HDAEAJAB)
- akta.pro secondary industry
- Attack Detection & Response for Cloud/SaaS (SOC for Cloud) (HDADAGAJ)
Keywords
Where SuperTokens is headquartered
LocationHeadquarters
- HQ city
- San Francisco
- HQ country
- United States
- HQ region
- North America
Markets served
SuperTokens business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Infrastructure, Marketing or Sales, Operations
Revenue model
- Open-Source Free Tier: Free open-source version with core authentication features including email/password, social login, and passwordless login. Users can self-host the SuperTokens Core.
- Managed Service (SaaS): Hosted service on supertokens.com for customers with less than 5000 MAUs. Free up to 5000 MAUs, then $0.02 per MAU. Includes unified login, M2M authentication, and attack protection features.
- Paid Feature Add-ons: Optional paid features including Multi-Factor Authentication (MFA), Multi-Tenancy, and Account Linking available on top of the free open-source version.
- Enterprise Plans: Enterprise pricing on request includes SLA guarantees, dedicated support, custom SLAs, and additional enterprise features. Migration support from Auth0 is offered by expert engineers.
- Professional Services: Migration consulting services for large user bases, including expert engineer assistance for implementing migration strategies from competitors like Auth0.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Others | Free Open-Source Tier |
| Usage-based | Monthly | Managed Service (Free Tier) |
| Usage-based | Monthly | Managed Service (Paid Tier) |
| Subscription | Multi-year contract | Enterprise |
Go-to-market motion2 records
Distribution channels4 records
Marketing channels7 records
SuperTokens product offering
Product offeringCore offering
SuperTokens provides an open-source user authentication platform that serves as an alternative to Auth0, Okta, Firebase Auth, and AWS Cognito. It delivers a modular SuperTokens Core service with frontend and backend SDKs across 25+ frameworks, supporting email/password, passwordless, magic link, social login, passkeys, SSO, multi-tenancy, account linking, machine-to-machine auth, and an Attack Protection Suite. The platform is offered as a free open-source self-hosted deployment or a managed cloud service with paid feature add-ons.
Product overview
SuperTokens is an open-source user authentication platform providing a modular, recipe-based architecture. The core SuperTokens Core service handles authentication logic, supported by frontend SDKs (React, Angular, Vue, React Native) and backend SDKs (Node.js, Python, Go). Authentication methods (Email Password, Passwordless/Magic Link, Social Login, Passkeys) are implemented as discrete recipes that can be combined. Enterprise features include Multi-Tenancy, SSO (SAML/OIDC), Account Linking, and Machine-to-Machine authentication. Security features include the Attack Protection Suite with CAPTCHA, brute-force prevention, and User Banning. The platform offers a User Management Dashboard for admin operations and a JWT Decoder tool for developers. Deployment options include managed cloud service (free up to 5,000 MAU) and self-hosted deployment. Recent additions include Unified Login for cross-domain authentication and an MCP Server for AI agent integration.
Differentiator
Problem solved
Functional benefit
Products and services
- SuperTokens Core The central authentication service that provides all authentication functionality and communicates with frontend and backend SDKs via API to perform authentication tasks. Available as a managed cloud service or self-hosted deployment for developers and enterprises building web and mobile applications.
- Email Password Login Traditional email and password authentication with customizable password policies, session management, and pre-built or custom UI components, used by developers integrating authentication into web and mobile applications.
- Passwordless Login Authentication without passwords using one-time passwords (OTP) via email or SMS, or magic links sent to user's email, for developers building frictionless login flows.
- Social Login Third-party social authentication providers (Google, Facebook, Apple, etc.) integrated via OAuth2/OpenID Connect protocols for developers adding social sign-in to applications.
- Magic Link Email-based passwordless authentication where users receive a unique URL link to complete login, with configurable expiration time, used by developers seeking frictionless sign-in.
- Passkeys Passwordless authentication using WebAuthn/FIDO2 standard, allowing users to authenticate with device-based credentials (fingerprint, face, security key). Targeted at developers seeking modern passwordless sign-in experiences.
- Single Sign On (SSO) Enterprise SSO capabilities supporting SAML and OIDC protocols for seamless authentication across multiple applications within an organization, targeted at enterprise customers.
- Attack Protection Suite Security bundle providing CAPTCHA protection (reCAPTCHA v2/v3, Cloudflare Turnstile), bot detection, brute-force prevention, rate limiting, user banning, and suspicious activity monitoring for applications requiring hardened authentication.
- Machine to Machine Authentication OAuth2 Client Credentials Flow implementation for authenticating microservices and service-to-service communication within distributed systems, targeted at engineering teams building microservice architectures.
- Unified Login Common OAuth2 Provider authentication across multiple frontend applications and domains, supporting multiple backends or shared backend architectures for enterprises running multi-application portfolios.
- Model Context Protocol (MCP) Server MCP server integration enabling AI agents and LLM tools (Cursor, VS Code, Windsurf, Claude) to access SuperTokens documentation and administer authentication configurations, targeted at AI-assisted developer workflows.
- Migration Consulting Services Expert engineering consultation and implementation services for migrating authentication systems from competitors such as Auth0 to SuperTokens, including bulk and lazy migration support, targeted at enterprises undergoing authentication platform transitions.
Quantifiable outcome
- Setup in 5 minutes with prebuilt UI components
- +3 more outcomes
Companies that use SuperTokens
Customer profileNamed customers10 records
Segments3 records
Ideal customer profiles3 records
SuperTokens technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration10 records
AI capability1 record
Feature10 records
SuperTokens partnerships and signals
Strategic signalScale indicators4 records
Recent moves6 records
Expansion highlights5 records
SuperTokens competitors and assessment
Company assessmentBroad incumbents
- Firebase Authentication: Google-owned developer auth service tightly coupled with Firebase/GCP. SuperTokens positions as a more flexible, vendor-neutral alternative with self-hosting options.
- Auth0 (Okta): Direct named competitor and the primary incumbent SuperTokens positions against. Offers hosted CIAM/SSO at enterprise scale; SuperTokens explicitly targets Auth0 customers with a transparent, self-hostable alternative.
- Okta: Workforce identity and CIAM leader that acquired Auth0. Competes on enterprise SSO, MFA, and directory services; SuperTokens targets the developer-friendly segment Okta/Auth0 has historically underserved on pricing.
- AWS Cognito: Cloud-native CIAM bundled with the AWS ecosystem. SuperTokens explicitly positions against Cognito's pricing complexity and lack of out-of-the-box cookie session management.
Direct peers
- Keycloak: Open-source IAM/SSO platform from Red Hat. Closest open-source competitor to SuperTokens with similar self-hosted architecture, but historically more enterprise-oriented and less developer-friendly out of the box.
- Clerk: Developer-first authentication and user management platform. Targets the same developer persona with prebuilt UIs and easy integration, competing on DX and framework support.
- Stytch: API-first authentication platform focused on passwordless, MFA, and B2B auth. Competes on developer experience and modern auth flows that overlap with SuperTokens' passwordless and passkey offerings.
- FusionAuth: Self-hostable and cloud authentication platform with similar feature set (OAuth, SSO, MFA, passwordless). Closest head-to-head competitor in the developer/auth-focused OSS-adjacent segment.
Emerging players
- WorkOS: Enterprise SSO/SCIM platform focused on B2B SaaS authentication. Competes in the enterprise SSO and directory sync segments where SuperTokens is investing (SAML, multi-tenancy).
- Descope: Developer-focused CIAM/authentication platform with drag-and-drop flows. Emerging player addressing similar developer persona with a flow-based approach to auth.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat5 records
Key risks4 records
Key highlights7 records
Customer concentration
SuperTokens social profiles
Digital presenceSuperTokens compliance and trust
Trust signalCompliance2 records
SuperTokens financial estimates
Financial estimateRevenue estimate
Valuation estimate
SuperTokens leadership team
Management profileNumber of profiles
Profiles1 record
SuperTokens funding detail
Funding detailFunding overview
Funding rounds4 records
Investors3 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
SuperTokens M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about SuperTokens
What does SuperTokens do?
SuperTokens provides an open-source user authentication platform that serves as an alternative to Auth0, Okta, Firebase Auth, and AWS Cognito. It delivers a modular SuperTokens Core service with frontend and backend SDKs across 25+ frameworks, supporting email/password, passwordless, magic link, social login, passkeys, SSO, multi-tenancy, account linking, machine-to-machine auth, and an Attack Protection Suite. The platform is offered as a free open-source self-hosted deployment or a managed cloud service with paid feature add-ons.
Is SuperTokens a public or private company?
SuperTokens is a private company. It is classified as venture growth investor backed and is currently operating.
When was SuperTokens founded?
SuperTokens was founded in 2019. It employs 11 to 50 people.
Where is SuperTokens based?
SuperTokens is headquartered in San Francisco, United States, in the North America region.
How does SuperTokens make money?
Five revenue lines are on record. Open-Source Free Tier is the primary driver. The others are managed Service (SaaS), paid Feature Add-ons, enterprise Plans and professional Services.
Who are SuperTokens's main competitors?
Broad incumbents on record are Firebase Authentication, Auth0 (Okta), Okta and AWS Cognito. Direct peers are Keycloak, Clerk, Stytch and FusionAuth. Emerging players are WorkOS and Descope.
Does SuperTokens have an API?
Yes. SuperTokens exposes a REST API through the SuperTokens Core service. SDKs (Node.js, Python, Go) communicate with this core via API calls to perform authentication tasks. The API supports authentication flows including OAuth2, session management, user management, and tenant management. The Managed service provides a hosted Core, while self-hosted deployments allow running SuperTokens Core in own infrastructure. API endpoints include OAuth2 authorization/token endpoints, recipe APIs for authentication methods (emailpassword, passwordless, social login), session APIs, and admin management endpoints. Developer documentation is at supertokens.com/docs.
What industry is SuperTokens in?
SuperTokens's product category is Identity and Access Management. Its primary akta.pro industry code is HDAEAJAB, Single Sign-On (SSO) & Federation (SAML/OIDC, Identity Providers), with a secondary code of HDADAGAJ, Attack Detection & Response for Cloud/SaaS (SOC for Cloud). Its NAICS code is 5415 and its SIC code is 7372.