SuperTokens is an open-source, modular authentication and authorization system built on a three-part architecture: a stateless HTTP core, a backend SDK, and a frontend SDK. It can be deployed as a self-hosted instance or a managed cloud service. The system uses a recipe-based architecture to provide modular login methods, including email/password, passwordless options such as passkeys and magic links, social logins, and enterprise single sign-on (SSO) via SAML and OpenID. The backend SDKs function as middleware for credential validation, session verification, and automatic token refreshing.
The platform's technical capabilities include multi-tenancy with support for isolated user pools, tenant-specific login configurations, and tenant discovery. Other core features are role-based access control (RBAC), multi-factor authentication (MFA), machine-to-machine (M2M) authentication, and an integrated attack protection suite. The system is designed for extensibility through overrides of default APIs, functions, and UI components, enabling custom logic for validation or token generation. It also includes a built-in user management dashboard and tools for migrating user data from other authentication providers.
