whichdevtool?
Menu
StacksDirectory Pricing changes Glossary
VPS and cloud servers App hosting and PaaS Managed databases Transactional email APIs Email marketing and newsletters Domain registrars CDN, DNS and edge security Monitoring, uptime and error tracking Auth and identity Frontend and full-stack frameworks Backend frameworks UI component libraries AI model APIs File and object storage Payments and billing Background jobs, queues and workflows ORMs and database toolkits

Open-source auth (self-host or managed)

SuperTokens

Open-source login and session management that runs on your own domain, free to self-host at any scale, or managed at $0.02 per monthly active user.

Visit supertokens.com ↗ Alternatives Open source Open source Self-hostable EU region
SuperTokens homepage
§1

Overview

SuperTokens is an open-core authentication system with three parts: a frontend SDK that renders login UI or lets you build your own, a backend SDK that exposes sign-up, sign-in and session APIs inside your own server, and the SuperTokens core, an HTTP service that holds auth logic and talks to the database. Because the login pages live on your own domain, there are no redirects to a third-party login page.

Self-hosting the open-source features is free at any scale: email and password, username or phone and password, social and custom OIDC providers, passwordless magic links and OTP, email verification, RBAC, session management and a user management dashboard. The managed service offers the same features for $0.02 per monthly active user, where new sign-ups count as active.

Some features cost money in both modes. MFA is $0.01 per MAU and other paid features such as multi-tenancy with enterprise SSO, acting as an OAuth 2.0 provider and M2M auth are $0.005 per MAU, each with a $100 monthly minimum. Extra dashboard users are $20 each. Check the add-on minimum before choosing it for a small app that needs MFA.

§2

Pricing and plans

Free tier · no card

Self-hosting the open-source features is free with no user limits: email/password, social and custom OIDC providers, passwordless, sessions, RBAC, user dashboard (3 dashboard users)

At the limit Not stated The vendor does not say what happens at the limit, or we have not found it yet.

Plan Price What you get
Self-hosted open source Free Core features, unlimited users, community support
Managed service $0.02/MAU Core features hosted by SuperTokens; MAU includes new sign-ups
MFA add-on $0.01/MAU Minimum $100/mo
Extra dashboard users $20/user/mo 3 dashboard users free
Other paid features $0.005/MAU Minimum $100/mo, e.g. $125/mo at 5,000 MAU; covers features such as multi-tenancy and M2M

The pricing page did not state whether the managed service has a free allowance, so no managed free tier is listed. Paid features are billed per MAU on top of the base with a $100/mo minimum. Volume discounts are offered above 10,000 MAU or more than 5 customer organisations. Professional support is priced on request. euRegion is true because self-hosting lets you choose location; managed-service regions were not checked.

Source: supertokens.com/pricing · prices as published, excluding tax.

§3

What it does

Login on your own domain
Prebuilt or custom UI served from your app, so users are not redirected to a vendor page.
Cookie-based sessions
Session management with rotating refresh tokens out of the box, verified in the backend SDK without calling the core.
Recipes and overrides
Modular recipes (email/password, passwordless, third-party) with hooks to override any behaviour.
Plugins
Plugins for CAPTCHA (reCAPTCHA or Turnstile), user banning and tenant discovery.
Multi-tenancy
Organisations with per-tenant login methods and enterprise SSO, as a paid feature.
Broad SDK support
Works with 25+ frameworks including React, Angular, Vue, Node.js, Go, Python, Android, iOS and Flutter.
§4

Strengths and limitations

Strengths

  • Free self-hosting of core features without user limits
  • Simple managed pricing at $0.02 per MAU
  • Auth UI stays on your domain
  • SOC 2 compliance listed for the managed service

Limitations

  • MFA is a paid add-on with a $100/mo minimum, even when self-hosting
  • Multi-tenancy, enterprise SSO and M2M are paid features
  • No free allowance for the managed service is stated on the pricing page
  • Self-hosting means running the Java-based core and a database
§5

Who it suits

Good for

  • Teams that want open-source auth they can self-host
  • Apps that need login pages on their own domain
  • Startups wanting predictable per-MAU managed pricing

Look elsewhere if

  • Small apps that need MFA but cannot justify $100/mo
  • Teams wanting a large enterprise feature set with no add-ons
§6

Alternatives to SuperTokens

Tool From Free option Stages
Casdoor Open-source IAM and SSO server with MCP gateway
— Free tier
Hanko Open-source passkey-first auth
$29/mo Free tier
Firebase Backend platform with document and realtime databases
Usage-based Free tier
Better Auth Open-source TypeScript auth library
$20/mo Free tier
Clerk Hosted auth and user management
$25/mo Free tier
Logto Open-source OIDC auth (cloud or self-hosted)
$24/mo Free tier

All auth and identity →

§7

Questions

Is SuperTokens free?

Self-hosting the open-source features is free with no user limits. The managed service costs $0.02 per monthly active user.

Does SuperTokens charge for MFA?

Yes. MFA is $0.01 per MAU with a $100 monthly minimum, in both managed and self-hosted setups.

Is SuperTokens open source?

Its core features are open source and can be self-hosted; some features such as MFA and multi-tenancy are paid.

What counts as a SuperTokens MAU?

Each unique logged-in user on your product in a month, including new sign-ups.

Sources read for this page