Nacho
SuperTokens IAM Provider
Open-source embedded authentication with no redirects — auth runs on your own domain. Recipe-based modular architecture. Self-hostable for free on PostgreSQL or MySQL, with optional managed cloud. Core differentiator: no hosted login page, no vendor domain in the auth flow.
Features
- 🇺🇸US🇪🇺EU🇸🇪🇱🇫🇭🇴🇸🇹🇪🇩Self-hosted
- AWSAzureGCPOn-premises
- JavaScriptTypeScriptReactReact NativeNext.jsNode.jsPythonGoJava.NETSwiftKotlinFlutter
If you want to compare IAM features of different providers, please check out the (C)IAM Identity Providers benchmark.
Looking for OpenID Connect protocol-level compatibility across providers? Check out the OpenID Connect Providers benchmark.
Frequently Asked Questions
Does SuperTokens support Username and Password authentication method?
SuperTokens supports Username and Password authentication method. Email/password authentication via the EmailPassword recipe. Supports sign-up, sign-in, email verification, and password reset flows. Username-based auth also available via the EmailPassword recipe with username as the login identifier. Pre-built React and React Native UI components included. Read more
Does SuperTokens support Social Sign-in authentication method?
SuperTokens supports Social Sign-in authentication method. Social login via the ThirdParty recipe. Built-in providers: Google, GitHub, Facebook, Apple, GitLab, Twitter/X, Discord, Bitbucket, LinkedIn, Okta, Active Directory, and any generic OIDC/OAuth2 provider. Can be combined with email/password via the ThirdPartyEmailPassword recipe. Read more
Does SuperTokens support Passkey authentication method?
SuperTokens supports Passkey authentication method. Passkeys (FIDO2/WebAuthn) supported as a primary authentication method via the WebAuthn recipe. Users can register and authenticate with biometric authenticators (Touch ID, Face ID, Windows Hello) or hardware security keys. Auth runs on the developer's own domain. Read more
Does SuperTokens support Email Passwordless authentication method?
SuperTokens supports Email Passwordless authentication method. Email OTP (one-time code) for passwordless sign-in via the Passwordless recipe. Configurable code expiry and length. Can be combined with magic links in the same flow. SMTP configuration required. Read more
Does SuperTokens support Phone Passwordless authentication method?
SuperTokens supports Phone Passwordless authentication method. Phone/SMS OTP for passwordless sign-in via the Passwordless recipe. Requires a configured SMS provider (Twilio, AWS SNS, or custom). Can be used alongside email OTP or standalone. Read more
Does SuperTokens support Magic Link authentication method?
SuperTokens supports Magic Link authentication method. Email magic link sign-in via the Passwordless recipe. One-time-use links sent to the user's email. Configurable expiry. Can be combined with OTP codes in the same flow (user sees both options). Read more
Does SuperTokens support Anonymous / Guest authentication method?
SuperTokens supports Anonymous / Guest authentication method. Anonymous sessions supported via the Session recipe — a session cookie is issued without requiring login. Developers track anonymous activity server-side and can link the session to a real user account upon sign-up. No dedicated 'anonymous user' record is created until conversion. Read more
Does SuperTokens support Time-based One-Time Password (TOTP) MFA?
SuperTokens supports Time-based One-Time Password (TOTP) MFA. TOTP (Time-based One-Time Password) MFA via the TOTP recipe, part of the MFA module. Self-hosted: included at no extra cost. Managed cloud: +$0.01/MAU add-on (minimum $100/month). Works with any TOTP authenticator app (Google Authenticator, Authy, etc.). Read more
Does SuperTokens support HMAC-based One-Time Password (HOTP) MFA?
SuperTokens does not support HMAC-based One-Time Password (HOTP) MFA. Counter-based HOTP is not supported. The MFA module supports TOTP (time-based), email OTP, and phone/SMS OTP as second factors. Read more
Does SuperTokens support Universal 2nd Factor (U2F) MFA?
SuperTokens does not support Universal 2nd Factor (U2F) MFA. U2F hardware security keys are not supported as a standalone MFA factor. WebAuthn/passkeys are available as a primary authentication method (not as a second factor). U2F is the predecessor spec to WebAuthn and not separately implemented. Read more
Does SuperTokens support WebAuthn MFA?
SuperTokens does not support WebAuthn MFA. WebAuthn/passkeys are implemented as a primary authentication method in the WebAuthn recipe, not as an MFA second factor. Step-up to a passkey challenge as a second factor is not natively supported in the MFA module. Read more
Does SuperTokens support Email Code MFA?
SuperTokens supports Email Code MFA. Email OTP as a second factor via the MFA module (Passwordless recipe as an MFA step). Self-hosted: included. Managed cloud: +$0.01/MAU add-on for the MFA module. Read more
Does SuperTokens support Phone Code MFA?
SuperTokens supports Phone Code MFA. Phone/SMS OTP as a second factor via the MFA module. Requires a configured SMS provider (Twilio, AWS SNS, custom). Self-hosted: free. Managed cloud: +$0.01/MAU add-on for the MFA module. Read more
Does SuperTokens support Recovery Code MFA?
SuperTokens does not support Recovery Code MFA. Recovery/backup codes are not natively supported as a built-in MFA fallback. Developers must implement a custom recovery flow. Read more
Does SuperTokens support Push Notification MFA?
SuperTokens does not support Push Notification MFA. Push notification MFA (e.g., Duo push, custom push) is not natively supported. Not in the MFA module. Read more
Does SuperTokens support Adaptive / Risk-Based MFA MFA?
SuperTokens does not support Adaptive / Risk-Based MFA MFA. Risk-based or adaptive MFA is not natively supported. Custom adaptive logic can be implemented by overriding the MFA recipe functions in the backend SDK to evaluate risk signals before requiring a second factor. Read more
Does SuperTokens support Cisco Duo MFA?
SuperTokens does not support Cisco Duo MFA. No native Cisco Duo integration. Duo can be reached indirectly via SAML/OIDC SSO federation (Enterprise plan only). Read more
Does SuperTokens support Step-Up Authentication MFA?
SuperTokens partially supports Step-Up Authentication MFA. Step-up authentication can be implemented by inspecting the session's completed_factors claim and requiring additional MFA factors for sensitive operations. No built-in declarative step-up policy — requires custom logic in the backend SDK overrides. Read more
Does SuperTokens support OpenID Connect (OIDC) integration protocol?
SuperTokens supports OpenID Connect (OIDC) integration protocol. SuperTokens acts as an OIDC/OAuth 2.1 provider. Issues JWTs with customizable claims for downstream service authorization. Standard OIDC endpoints available. Custom OIDC/OAuth2 providers can be added as social login via the ThirdParty recipe. Read more
Does SuperTokens support SAML 2.0 integration protocol?
SuperTokens supports SAML 2.0 integration protocol. SAML 2.0 support available via the dedicated SAML recipe. Can act as a SAML SP connecting to external IdPs. Enterprise plan required for the SSO/SAML functionality in the managed cloud. Read more
Does SuperTokens support WS-Federation integration protocol?
SuperTokens does not support WS-Federation integration protocol. WS-Federation is not supported. SuperTokens supports OIDC and SAML 2.0 as federation protocols. Read more
Does SuperTokens support Machine-to-Machine (M2M) Authentication integration protocol?
SuperTokens supports Machine-to-Machine (M2M) Authentication integration protocol. Machine-to-machine authentication via the M2M recipe. Enterprise plan required on managed cloud. Self-hosted deployments can use the M2M recipe without restriction. Implements OAuth 2.1 client credentials flow. Read more
Does SuperTokens support OpenID Connect (OIDC) Federation identity federation?
SuperTokens supports OpenID Connect (OIDC) Federation identity federation. OIDC enterprise SSO federation via the ThirdParty recipe and dedicated SSO module. Enterprise plan required on managed cloud. Any OIDC-compliant IdP supported (Okta, Auth0, Google Workspace, etc.). Self-hosted includes this without restrictions. Read more
Does SuperTokens support SAML 2.0 Federation identity federation?
SuperTokens supports SAML 2.0 Federation identity federation. SAML 2.0 enterprise IdP federation. Enterprise plan required on managed cloud. Any SAML 2.0 IdP supported (Microsoft Entra ID, Okta, etc.). Self-hosted deployments have full access to the SAML recipe. Read more
Does SuperTokens support Active Directory / LDAP identity federation?
SuperTokens does not support Active Directory / LDAP identity federation. No native LDAP or Active Directory connector. AD can be federated via SAML 2.0 or OIDC using Microsoft Entra ID (Azure AD) as an IdP via the ThirdParty recipe. Read more
Does SuperTokens support Azure Active Directory (Entra ID) identity federation?
SuperTokens supports Azure Active Directory (Entra ID) identity federation. Microsoft Entra ID (Azure AD) supported as a social login provider via the ThirdParty recipe (OAuth2/OIDC). For enterprise SSO with SAML or OIDC federation, the Enterprise plan (or self-hosted) is required. Read more
Does SuperTokens support Bulk User Import user management?
SuperTokens supports Bulk User Import user management. Bulk user import via the User Import API — accepts arrays of users with credentials, metadata, and roles. Supports importing users without triggering sign-up hooks. Available on all plans. Read more
Does SuperTokens support Password Hash Import (Multiple Formats) user management?
SuperTokens supports Password Hash Import (Multiple Formats) user management. Password hash import supported for bcrypt, Argon2, and Firebase scrypt hashes. Users can sign in with their original passwords immediately post-migration without a reset step. Read more
Does SuperTokens support Bulk User Export user management?
SuperTokens does not support Bulk User Export user management. No dedicated REST API for bulk user export. On self-hosted deployments, users can be exported by querying the SuperTokens database (PostgreSQL or MySQL) directly. No export tooling provided out of the box. Read more
Does SuperTokens support Bulk User Update / Delete user management?
SuperTokens supports Bulk User Update / Delete user management. Bulk user operations available via the Admin API (Node.js, Python, Go, Java, .NET). Delete, update metadata, and revoke sessions for multiple users programmatically. No single batch endpoint — requires scripted individual API calls. Read more
Does SuperTokens support Upsert on Import user management?
SuperTokens does not support Upsert on Import user management. The import API does not support upsert semantics. Importing a user whose email already exists will result in a duplicate or error. Pre-check for existing users before importing. Read more
Does SuperTokens support Legacy Username Import (Non-Allowed Characters) user management?
SuperTokens does not support Legacy Username Import (Non-Allowed Characters) user management. No special handling for importing legacy usernames with non-standard characters. The EmailPassword recipe uses email as the primary login identifier. Username-based auth requires using the username field which enforces alphanumeric constraints. Read more
Does SuperTokens support MFA Enrollment Import user management?
SuperTokens does not support MFA Enrollment Import user management. Importing pre-existing TOTP secrets or MFA enrollments is not supported. Users must re-enroll in MFA after migration. Read more
Does SuperTokens support Inbound SCIM Provisioning user management?
SuperTokens does not support Inbound SCIM Provisioning user management. SCIM 2.0 is not supported. User provisioning from enterprise IdPs must use the SuperTokens Admin API directly or a custom integration layer. Read more
Does SuperTokens support Outbound SCIM Provisioning user management?
SuperTokens does not support Outbound SCIM Provisioning user management. No outbound SCIM provisioning to downstream applications. Read more
Does SuperTokens support SCIM Groups Provisioning user management?
SuperTokens does not support SCIM Groups Provisioning user management. No SCIM group management. Groups and roles are managed via the User Roles recipe. Read more
Does SuperTokens support Just-In-Time (JIT) User Provisioning user management?
SuperTokens supports Just-In-Time (JIT) User Provisioning user management. Just-in-time provisioning: users are automatically created on first social/ThirdParty login. The sign-up override hook allows custom logic during provisioning (e.g., role assignment, metadata enrichment). Read more
Does SuperTokens support Lazy / Trickle Migration from Legacy Database user management?
SuperTokens supports Lazy / Trickle Migration from Legacy Database user management. Zero-downtime lazy migration supported: the EmailPassword sign-in override intercepts failed local auth, falls back to the legacy system to verify credentials, then creates the user locally on success. Bulk import API provides an alternative for pre-migration. Works on all plan tiers (self-hosted and managed cloud). Read more
Does SuperTokens support Self-Service Profile Management Portal user management?
SuperTokens partially supports Self-Service Profile Management Portal user management. No built-in self-service profile management page. Users can update their own metadata and password via the SDK. Developers must build profile management UI using the supertokens-auth-react components or a custom implementation. Read more
Does SuperTokens support User Account Linking user management?
SuperTokens supports User Account Linking user management. Account linking supported via the Account Linking recipe — merges multiple login methods (email/password, social, passwordless) into a single user record. Managed cloud: +$0.005/MAU add-on. Self-hosted: included at no extra cost. Read more
Does SuperTokens support User Blocking / Banning user management?
SuperTokens supports User Blocking / Banning user management. Users can be banned/disabled via the Admin API or the built-in user management dashboard. Banned users have their active sessions revoked and cannot create new sessions. Read more
Does SuperTokens support User Metadata user management?
SuperTokens supports User Metadata user management. Arbitrary user metadata stored via the User Metadata recipe (a dedicated key-value store per user). Accessible from both the backend SDK and the frontend SDK (with appropriate permissions). Available on all plans. Read more
Does SuperTokens support Application Metadata user management?
SuperTokens supports Application Metadata user management. Admin-controlled metadata stored via the User Metadata recipe. Server-side update ensures that sensitive app metadata (e.g., roles, plan info) cannot be modified by the end user. Custom JWT claims include this metadata. Read more
Does SuperTokens support Metadata Size Limits user management?
SuperTokens partially supports Metadata Size Limits user management. No officially documented metadata size limit. On self-hosted deployments, metadata is stored in the SuperTokens database (PostgreSQL or MySQL) as a JSON blob. Practical limits depend on database configuration. Large metadata payloads included in JWTs should be kept under 8 KB to avoid HTTP header issues. Read more
Does SuperTokens support User Search user management?
SuperTokens supports User Search user management. User search available via the built-in Admin Dashboard (filter by email, phone, recipe type) and via the Admin API. Search by email, phone number, and thirdparty provider supported. Available on all plans. Read more
Does SuperTokens support Role-Based Access Control (RBAC) user management?
SuperTokens supports Role-Based Access Control (RBAC) user management. Role-Based Access Control via the User Roles recipe. Create roles, assign permissions to roles, assign roles to users and tenants. Roles and permissions included in session JWTs. Built-in API for role/permission management. Dashboard for admin management. Available on all plans. Read more
Does SuperTokens support Organizations (Multi-Tenancy B2B) user management?
SuperTokens supports Organizations (Multi-Tenancy B2B) user management. Multi-tenancy via the Multi-tenancy recipe. Each tenant has isolated user pools, login methods, and SSO configurations. Supports tenant creation/deletion via Admin API, per-tenant login page, and shared users across tenants. Available on all plans. Read more
Does SuperTokens support Password Strength Policies user management?
SuperTokens supports Password Strength Policies user management. Password strength policy configurable in the EmailPassword recipe initialization: minimum length, require uppercase/lowercase/numbers/special characters. Custom validators can be added via the override mechanism for more complex policies. Read more
Does SuperTokens support Username Restrictions user management?
SuperTokens supports Username Restrictions user management. Username format restrictions configurable in the EmailPassword recipe. Custom username validators can be added via the override mechanism. Uniqueness is enforced natively. Read more
Does SuperTokens support Progressive Profiling / Forms user management?
SuperTokens does not support Progressive Profiling / Forms user management. No built-in progressive profiling flow. Can be implemented at the application layer using User Metadata and custom UI. Read more
Does SuperTokens support Attribute-Based Access Control (ABAC) access control?
SuperTokens does not support Attribute-Based Access Control (ABAC) access control. No native attribute-based access control policy engine. Custom ABAC can be implemented by including user attributes in JWT claims and enforcing policies in application middleware. Read more
Does SuperTokens support Fine-Grained Authorization (FGA / ReBAC) access control?
SuperTokens does not support Fine-Grained Authorization (FGA / ReBAC) access control. No relationship-based or fine-grained authorization engine (no ReBAC, no OpenFGA integration). Authorization beyond RBAC must be implemented at the application layer. Read more
Does SuperTokens support API Authorization (Scopes / Permissions) access control?
SuperTokens supports API Authorization (Scopes / Permissions) access control. Session JWT validation for API authorization. Backend SDKs provide middleware for all major frameworks (Express, FastAPI, Django, Spring, etc.) to verify sessions and check roles/permissions on each request. Read more
Does SuperTokens support Audit Log Retention security feature?
SuperTokens partially supports Audit Log Retention security feature. On self-hosted deployments, auth events are written to the SuperTokens database tables — retention is controlled by the operator. Managed cloud has limited built-in log visibility. No dedicated audit log retention policy or configurable retention period on managed cloud. Read more
Does SuperTokens support Audit Log Streaming security feature?
SuperTokens does not support Audit Log Streaming security feature. No native audit log streaming to external SIEM or logging platforms. On self-hosted, logs can be captured from the database or application server and forwarded to external systems at the infrastructure level. Read more
Does SuperTokens support Security Center (Threat Monitoring Dashboard) security feature?
SuperTokens does not support Security Center (Threat Monitoring Dashboard) security feature. No dedicated security monitoring dashboard or threat intelligence center. Auth events visible in the built-in user management dashboard but no real-time security alerting. Read more
Does SuperTokens support Encryption at Rest security feature?
SuperTokens supports Encryption at Rest security feature. Managed cloud: data encrypted at rest by the underlying cloud provider. Self-hosted: encryption at rest is the responsibility of the operator's infrastructure (e.g., encrypted EBS volumes, RDS encryption). Read more
Does SuperTokens support Encryption in Transit security feature?
SuperTokens supports Encryption in Transit security feature. All SuperTokens Core API connections use TLS. Backend SDK to Core communication can be configured with API keys over HTTPS. Self-hosted: TLS must be configured by the operator at the reverse proxy or application level. Read more
Does SuperTokens support Customer Managed Keys (BYOK) security feature?
SuperTokens does not support Customer Managed Keys (BYOK) security feature. Customer-managed encryption keys not available on the managed cloud. Self-hosted deployments give full control over encryption keys at the database and storage level. Read more
Does SuperTokens support Bot Detection security feature?
SuperTokens partially supports Bot Detection security feature. Bot detection available as part of the Attack Protection Suite (Enterprise plan). Includes CAPTCHA integration (reCAPTCHA v2/v3, Cloudflare Turnstile). Not included in Self-hosted or Managed Cloud standard plans. Read more
Does SuperTokens support Brute Force Protection security feature?
SuperTokens supports Brute Force Protection security feature. Built-in rate limiting on sign-in attempts via the EmailPassword recipe. Failed attempts are tracked and throttled. Configurable via the recipe initialization. Available on all plans. Read more
Does SuperTokens support Suspicious IP Throttling security feature?
SuperTokens partially supports Suspicious IP Throttling security feature. IP-level suspicious activity detection part of the Attack Protection Suite (Enterprise plan). Standard plans include only basic rate limiting without IP intelligence. Read more
Does SuperTokens support Breached Password Detection security feature?
SuperTokens partially supports Breached Password Detection security feature. Breached/compromised password detection part of the Attack Protection Suite (Enterprise plan). Checks against known credential breach databases. Not available on Self-hosted or standard Managed Cloud plans without Enterprise. Read more
Does SuperTokens support Credential Guard (Dark Web Monitoring) security feature?
SuperTokens does not support Credential Guard (Dark Web Monitoring) security feature. No proactive dark web monitoring or credential stuffing guard. Breached password detection at sign-up/change is available on Enterprise plan only. Read more
Does SuperTokens support Tenant Access Control List (IP ACL) security feature?
SuperTokens does not support Tenant Access Control List (IP ACL) security feature. No tenant-level access control lists for restricting auth traffic by IP or geography. Access control must be enforced at the reverse proxy or application layer. Read more
Does SuperTokens support Device Fingerprinting security feature?
SuperTokens does not support Device Fingerprinting security feature. No built-in device fingerprinting. Sessions are cookie/JWT based without device-level identification. Third-party fingerprinting libraries can be integrated at the application layer. Read more
Does SuperTokens support Per-Organization Branding multi-tenancy?
SuperTokens does not support Per-Organization Branding multi-tenancy. No per-tenant branding support. The pre-built React UI uses global theme configuration. Per-tenant custom UI requires building a fully custom authentication flow. Read more
Does SuperTokens support Per-Organization MFA Policy multi-tenancy?
SuperTokens does not support Per-Organization MFA Policy multi-tenancy. MFA policies are configured globally, not per tenant. Per-tenant MFA enforcement requires custom logic in the MFA recipe override. Read more
Does SuperTokens support Hosted / Universal Login Page branding feature?
SuperTokens does not support Hosted / Universal Login Page branding feature. SuperTokens is embedded-only by design — a core architectural differentiator. There is no hosted login page or redirect-based auth flow. Auth UI runs entirely on the developer's own domain, eliminating the vendor's subdomain from the user journey. Read more
Does SuperTokens support Embedded / Native Login Components branding feature?
SuperTokens supports Embedded / Native Login Components branding feature. Core product feature: auth runs on the developer's own domain with no redirects. Pre-built React and React Native UI components provided. The backend SDK exposes API routes that the frontend components communicate with directly. No cross-domain auth flow. Read more
Does SuperTokens support White-Label / Full Brand Removal branding feature?
SuperTokens supports White-Label / Full Brand Removal branding feature. Full white-labeling by design — auth runs on the developer's own domain with no SuperTokens branding. The open-source UI components are fully customizable. CSS and component overrides supported. No paid brand-removal add-on required. Read more
Does SuperTokens support Localization / i18n branding feature?
SuperTokens partially supports Localization / i18n branding feature. Pre-built UI components have limited built-in i18n support. Translation strings can be overridden in the component configuration for supported languages. Full localization for all languages requires building a custom UI. Read more
Does SuperTokens support Prebuilt UI Components (SDK) branding feature?
SuperTokens supports Prebuilt UI Components (SDK) branding feature. Pre-built UI provided as supertokens-auth-react (React) and supertokens-react-native (React Native). Components for sign-in, sign-up, password reset, email verification, MFA enrollment, and session management. Customizable via theme overrides and override components. Read more
Does SuperTokens support Login / Auth Analytics Dashboard analytics?
SuperTokens partially supports Login / Auth Analytics Dashboard analytics. Built-in admin dashboard shows user counts, active sessions, and basic user activity. No dedicated authentication analytics (funnel rates, MAU trends, geographic distribution). Detailed analytics require exporting data from the database on self-hosted, or integrating an external analytics platform. Read more
Does SuperTokens support SOC 2 Type II Certification compliance?
SuperTokens supports SOC 2 Type II Certification compliance. SuperTokens is SOC 2 Type 2 certified. The certification covers the managed cloud service. Read more
Does SuperTokens support ISO 27001 / 27017 / 27018 Certification compliance?
SuperTokens does not support ISO 27001 / 27017 / 27018 Certification compliance. ISO 27001 certification is not held by SuperTokens. Self-hosted deployments rely on the developer's own infrastructure compliance. Read more
Does SuperTokens support HIPAA Business Associate Agreement (BAA) compliance?
SuperTokens does not support HIPAA Business Associate Agreement (BAA) compliance. HIPAA BAA is not available. For HIPAA-regulated workloads, self-hosted deployment on HIPAA-compliant infrastructure is the recommended path. Read more
Does SuperTokens support PCI DSS Compliance compliance?
SuperTokens does not support PCI DSS Compliance compliance. PCI DSS compliance is not certified. SuperTokens is an authentication service and does not process payment data. Read more
Does SuperTokens support CSA STAR Certification compliance?
SuperTokens does not support CSA STAR Certification compliance. CSA STAR certification not held by SuperTokens. Read more
Does SuperTokens support FedRAMP Authorization compliance?
SuperTokens does not support FedRAMP Authorization compliance. FedRAMP authorization not held by SuperTokens. Self-hosted deployment on FedRAMP-authorized cloud infrastructure is required for federal government use cases. Read more
Does SuperTokens support GDPR: Data Export (Portability) compliance?
SuperTokens supports GDPR: Data Export (Portability) compliance. User data export via the Admin API (get user by ID, list sessions, get metadata). On self-hosted deployments, direct database access enables bulk export. Developers are responsible for exporting data from all related application tables. Read more
Does SuperTokens support GDPR: Right to be Forgotten (User Deletion) compliance?
SuperTokens supports GDPR: Right to be Forgotten (User Deletion) compliance. User deletion via the Admin API deletes the SuperTokens user record, sessions, metadata, roles, and third-party identities. Application data in external databases must be deleted separately. Read more
Does SuperTokens support Consent Management compliance?
SuperTokens does not support Consent Management compliance. No built-in consent management module. Consent must be captured and stored at the application layer using User Metadata. Read more
Does SuperTokens support Region Deployment compliance?
SuperTokens supports Region Deployment compliance. Self-hosted deployments give full data residency control — deploy anywhere. Managed cloud region selection available (US and EU). For strict data residency requirements, self-hosting is recommended. Read more
Does SuperTokens support Private Cloud Deployment compliance?
SuperTokens supports Private Cloud Deployment compliance. Open-source core is self-hostable on any cloud provider or on-premises with PostgreSQL or MySQL as the backend database. Docker images and Helm charts available. Enterprise plan provides SLA-backed managed deployments with multiple availability zones. Read more
Does SuperTokens support SDK Coverage developer integration?
SuperTokens supports SDK Coverage developer integration. Backend SDKs: Node.js (Express, Hapi, Fastify, Koa, Nest.js), Python (Django, FastAPI, Flask), Go (net/http, Chi, Gin, Fiber), Java (Spring Boot), .NET (ASP.NET Core). Frontend SDKs: React, React Native, Vanilla JS, Next.js (app + pages router). Mobile: iOS (Swift), Android (Kotlin), Flutter. 25+ frameworks supported. Read more
Does SuperTokens support Management API developer integration?
SuperTokens supports Management API developer integration. SuperTokens Core exposes a REST API (accessible only from the backend SDK or with an API key). Full user management: CRUD operations, session management, roles/permissions, metadata, MFA enrollment, tenant management. Swagger-documented. Read more
Does SuperTokens support Authentication API Rate Limits developer integration?
SuperTokens supports Authentication API Rate Limits developer integration. Rate limits on sign-in attempts configurable in the EmailPassword recipe. Core API has built-in rate limiting on failed auth attempts. Self-hosted: additional infrastructure-level rate limiting (Nginx, load balancer) controlled by the operator. Read more
Does SuperTokens support Actions / Extensibility Pipeline developer integration?
SuperTokens supports Actions / Extensibility Pipeline developer integration. Override any recipe function in the backend SDK: sign-up, sign-in, token creation, session refresh, sign-out, etc. Full control over all auth lifecycle events without limits on execution environment. Overrides are written in the same language as the backend SDK (Node.js, Python, Go, Java, .NET). Read more
Does SuperTokens support TypeScript Support in Extensibility developer integration?
SuperTokens supports TypeScript Support in Extensibility developer integration. Node.js backend SDK is written in TypeScript with full TypeScript support for all recipe overrides. Python, Go, Java, and .NET SDKs support their respective type systems. Read more
Does SuperTokens support Custom Domain developer integration?
SuperTokens supports Custom Domain developer integration. Auth runs on the developer's own domain by default — no configuration required. The SuperTokens Core API is deployed at a developer-specified URL (typically an internal service URL). The frontend SDK is configured to point to the developer's own backend routes. Read more
Does SuperTokens support Deploy CLI (Infrastructure as Code) developer integration?
SuperTokens does not support Deploy CLI (Infrastructure as Code) developer integration. No official CLI tool for SuperTokens deployment or configuration management. Infrastructure is managed via Docker, Helm charts, or cloud provider tooling. Configuration is done via environment variables and the backend SDK initialization. Read more
Does SuperTokens support Terraform Provider developer integration?
SuperTokens does not support Terraform Provider developer integration. No official Terraform provider for SuperTokens. Infrastructure provisioning is managed via standard cloud infrastructure tools. Community contributions exist but are not officially maintained. Read more
Does SuperTokens support Custom Database Connections developer integration?
SuperTokens supports Custom Database Connections developer integration. SuperTokens Core requires PostgreSQL or MySQL as the backend database. Self-hosted deployments use the operator's existing database infrastructure. No custom connector scripts needed — SuperTokens manages its own schema within the configured database. Read more
Does SuperTokens support Native Webhook Support developer integration?
SuperTokens supports Native Webhook Support developer integration. Webhooks supported via the recipe override mechanism and outgoing HTTP calls from backend SDK overrides. Any auth lifecycle event can trigger an outbound webhook. No hosted webhook management UI — implemented in backend code. Read more
Does SuperTokens support Universal Login / Hosted Login Page Customization developer integration?
SuperTokens does not support Universal Login / Hosted Login Page Customization developer integration. No hosted login page to customize. SuperTokens is embedded-only — the developer owns the entire UI. Customization is done via component override props and CSS in the supertokens-auth-react library. Read more
Does SuperTokens support Custom Email Provider (SMTP) developer integration?
SuperTokens supports Custom Email Provider (SMTP) developer integration. Custom email provider configurable in recipe initialization via the emailDelivery.override field. Send email via any SMTP server or HTTP API (SendGrid, SES, Mailgun, Postmark, etc.) by overriding the sendEmail function in the backend SDK. Read more
Does SuperTokens support Email Templates developer integration?
SuperTokens supports Email Templates developer integration. Built-in email templates for email verification, password reset, magic link, and OTP flows. Fully customizable — override the sendEmail function to modify subject, body, and sender. HTML and plaintext templates supported. Read more
Does SuperTokens support Custom OIDC Claims / Token Enrichment developer integration?
SuperTokens supports Custom OIDC Claims / Token Enrichment developer integration. Custom JWT/session claims added via the Session recipe override (createNewSession or getAccessTokenPayload). Any additional data can be included in the access token payload. Session claim validators enforce claim presence/value on the frontend. Read more
Does SuperTokens support No-Code Auth Flow Builder / Orchestration feature?
SuperTokens does not support No-Code Auth Flow Builder / Orchestration feature. No visual/no-code authentication flow builder. Auth flows are configured programmatically in the backend SDK recipe initialization. Read more
Does SuperTokens support Identity Verification / Document Proofing feature?
SuperTokens does not support Identity Verification / Document Proofing feature. No built-in identity document verification or biometric liveness proofing. Must be integrated at the application layer via third-party services. Read more
Does SuperTokens support Decentralized / Verifiable Credentials feature?
SuperTokens does not support Decentralized / Verifiable Credentials feature. No support for W3C Verifiable Credentials, DIDs, or wallet-based authentication. Read more
Does SuperTokens support Built-in Billing / Subscription Management feature?
SuperTokens does not support Built-in Billing / Subscription Management feature. No native billing or subscription management integration. Must be handled at the application layer via third-party billing services. Read more
Does SuperTokens support Agentic AI / MCP Server Authentication feature?
SuperTokens does not support Agentic AI / MCP Server Authentication feature. No native MCP (Model Context Protocol) authorization or AI agent identity flows. OAuth 2.1 M2M tokens (Enterprise plan) can be used for machine-to-machine agent authentication but without dedicated MCP-spec tooling. Read more
Does SuperTokens support Post-Quantum Digital Signature Algorithms post-quantum cryptography feature?
SuperTokens does not support Post-Quantum Digital Signature Algorithms post-quantum cryptography feature. No public evidence found of ML-DSA/SLH-DSA/Falcon support for session JWT signing in SuperTokens. No GitHub issues or blog posts on PQC signature algorithms were found in the supertokens-core or related repositories.
Does SuperTokens support Post-Quantum Token & Data Encryption post-quantum cryptography feature?
SuperTokens does not support Post-Quantum Token & Data Encryption post-quantum cryptography feature. No public evidence found that the provider supports ML-KEM or HPKE (RFC 9180) for encrypting JWE tokens, SAML assertions, or user secrets.
Does SuperTokens support Post-Quantum Certificate & mTLS Support post-quantum cryptography feature?
SuperTokens does not support Post-Quantum Certificate & mTLS Support post-quantum cryptography feature. No public evidence found of post-quantum or hybrid X.509 digital certificate support for mTLS client authentication or federation endpoints.
Does SuperTokens support Post-Quantum Stateful Hash Signatures post-quantum cryptography feature?
SuperTokens does not support Post-Quantum Stateful Hash Signatures post-quantum cryptography feature. No public evidence found of NIST SP 800-208 stateful hash-based signature scheme support (LMS/HSS, XMSS).
Compare with other providers
Note: The current data is based on provider documentation/experience and may not be 100% accurate. Please open an issue if you have spotted any inconsistencies.