Introduction
Add secure, customizable authentication and session management to your applications with SuperTokens.
SuperTokens is an open-source authentication provider that gives you control over your user data and login experience. Use the managed service or self-host the SuperTokens Core, then integrate authentication through frontend and backend SDKs.
Quickstart
Integrate SuperTokens into an existing application.
Migration
Replace an existing authentication provider with SuperTokens.
How SuperTokens works
The SuperTokens Core provides the authentication functionality. Your backend SDK communicates with the Core to perform authentication tasks, while the frontend SDK sends requests to authentication routes exposed by your backend.
Unlike many authentication providers, the frontend SDK never communicates with the authentication service directly. This lets your application control the API layer, customize authentication behavior, and keep the Core inside your infrastructure when self-hosting.
Recipes
SuperTokens groups functionalities, like authentication methods or session and user management actions, into recipes. Each can be used as extendable building blocks which allow you to customize the authentication experience based on your needs.
Explore capabilities
Email/password authentication
Let users sign up and sign in with an email and password, with customizable forms and password reset flows.
Passwordless authentication
Authenticate users with one-time passwords or magic links sent by email or SMS.
Social login
Let users sign in with Google, Apple, GitHub, and other identity providers.
Passkeys
Offer phishing-resistant sign-in using biometrics, device PINs, or security keys.
Unified login
Authenticate users across web, mobile, and desktop applications through a common OAuth2 provider.
Machine-to-machine authentication
Secure service-to-service requests with access tokens using the OAuth2 client credentials flow.
Multi-factor authentication
Add email or SMS OTP, TOTP, or passkeys as factors, with step-up authentication for sensitive actions.
Attack Protection Suite
Detect risky authentication activity and respond with extra verification or blocked attempts.
Enterprise login and multitenancy
Configure tenant-specific login methods, isolated user pools, and enterprise SSO.
Next steps
Choose an authentication method
Configure the sign-in methods that fit your application.
Manage users and sessions
Protect routes, manage sessions, and work with authenticated users.
Integrate with AI
Give an AI coding agent the context it needs to integrate SuperTokens.
Deploy SuperTokens
Use the managed service or deploy the SuperTokens Core yourself.