Overview
SuperTokens is an open-core authentication system with three parts: a frontend SDK that renders login UI or lets you build your own, a backend SDK that exposes sign-up, sign-in and session APIs inside your own server, and the SuperTokens core, an HTTP service that holds auth logic and talks to the database. Because the login pages live on your own domain, there are no redirects to a third-party login page.
Self-hosting the open-source features is free at any scale: email and password, username or phone and password, social and custom OIDC providers, passwordless magic links and OTP, email verification, RBAC, session management and a user management dashboard. The managed service offers the same features for $0.02 per monthly active user, where new sign-ups count as active.
Some features cost money in both modes. MFA is $0.01 per MAU and other paid features such as multi-tenancy with enterprise SSO, acting as an OAuth 2.0 provider and M2M auth are $0.005 per MAU, each with a $100 monthly minimum. Extra dashboard users are $20 each. Check the add-on minimum before choosing it for a small app that needs MFA.
Pricing and plans
checked 28 Sept 2026Free tier · no card
Self-hosting the open-source features is free with no user limits: email/password, social and custom OIDC providers, passwordless, sessions, RBAC, user dashboard (3 dashboard users)
| Plan | Price | What you get |
|---|---|---|
| Self-hosted open source | Free | Core features, unlimited users, community support |
| Managed service | $0.02/MAU | Core features hosted by SuperTokens; MAU includes new sign-ups |
| MFA add-on | $0.01/MAU | Minimum $100/mo |
| Extra dashboard users | $20/user/mo | 3 dashboard users free |
| Other paid features | $0.005/MAU | Minimum $100/mo, e.g. $125/mo at 5,000 MAU; covers features such as multi-tenancy and M2M |
What it does
- Login on your own domain
- Prebuilt or custom UI served from your app, so users are not redirected to a vendor page.
- Cookie-based sessions
- Session management with rotating refresh tokens out of the box, verified in the backend SDK without calling the core.
- Recipes and overrides
- Modular recipes (email/password, passwordless, third-party) with hooks to override any behaviour.
- Plugins
- Plugins for CAPTCHA (reCAPTCHA or Turnstile), user banning and tenant discovery.
- Multi-tenancy
- Organisations with per-tenant login methods and enterprise SSO, as a paid feature.
- Broad SDK support
- Works with 25+ frameworks including React, Angular, Vue, Node.js, Go, Python, Android, iOS and Flutter.
Strengths and limitations
Strengths
- Free self-hosting of core features without user limits
- Simple managed pricing at $0.02 per MAU
- Auth UI stays on your domain
- SOC 2 compliance listed for the managed service
Limitations
- MFA is a paid add-on with a $100/mo minimum, even when self-hosting
- Multi-tenancy, enterprise SSO and M2M are paid features
- No free allowance for the managed service is stated on the pricing page
- Self-hosting means running the Java-based core and a database
Who it suits
Good for
- Teams that want open-source auth they can self-host
- Apps that need login pages on their own domain
- Startups wanting predictable per-MAU managed pricing
Look elsewhere if
- Small apps that need MFA but cannot justify $100/mo
- Teams wanting a large enterprise feature set with no add-ons
Alternatives to SuperTokens
| Tool | From | Free option | Stages |
|---|---|---|---|
| Amazon Cognito Cloud user directory and auth service | Usage-based | Free tier | |
| Asgardeo Hosted CIAM (with open-source self-hosted option) | $20/mo | Free tier | |
| Authgear Open-source CIAM (cloud, VPC or one-time self-host licence) | $50/mo | Free tier | |
| Better Auth Open-source TypeScript auth library | $20/mo | Free tier | |
| Casdoor Open-source IAM and SSO server with MCP gateway | — | Free tier | |
| Clerk Hosted auth and user management | $25/mo | Free tier |
Questions
Is SuperTokens free?
Self-hosting the open-source features is free with no user limits. The managed service costs $0.02 per monthly active user.
Does SuperTokens charge for MFA?
Yes. MFA is $0.01 per MAU with a $100 monthly minimum, in both managed and self-hosted setups.
Is SuperTokens open source?
Its core features are open source and can be self-hosted; some features such as MFA and multi-tenancy are paid.
What counts as a SuperTokens MAU?
Each unique logged-in user on your product in a month, including new sign-ups.
Sources read for this page