SuperTokens

SuperTokens approaches authentication from the application developer's perspective rather than the infrastructure administrator's. Instead of a standalone identity server you configure through an admin UI, it is a modular library that plugs into your existing backend. You pick the recipes you need — email/password, social OAuth, magic links, OTP, multi-tenancy — and each one ships with both a headless API and optional pre-built React UI components that you can drop in or replace entirely.

The session management implementation is a particular strength. SuperTokens uses rotating refresh tokens with automatic token theft detection, storing session state in a separate service (the core) rather than in JWTs alone. That design avoids a common vulnerability in stateless JWT authentication — the inability to revoke sessions instantly — while keeping the verification path fast by caching session validation locally in the backend SDK.

Self-hosting runs the open-source core (Apache-2.0) alongside your application, typically as a small Docker container backed by PostgreSQL or MySQL. The managed cloud option handles the core for you and includes a free tier up to 5,000 MAUs, making it a credible no-ops starting point for early-stage products. SAML SSO for enterprise customers and advanced MFA options require the paid plan. The trade-off versus alternatives like Keycloak or authentik is scope: SuperTokens is narrower, covering application-level auth well but not enterprise federation protocols like LDAP or RADIUS. For developer-led teams building SaaS products, that narrower focus is usually a feature rather than a limitation.