In simple English
When you build an app, your users need a way to log in and stay logged in. Building this from scratch takes weeks and creates big security risks. Existing cloud services charge you money once your user base starts to grow. This project is a self-hosted login system that you run on your own server. It handles passwords, social logins, and active sessions completely for free.
What it is
SuperTokens Core is an open-source HTTP service that handles authentication and session logic for applications. It works alongside frontend and backend software development kits (software tools that help programmers build for a specific platform) to manage user accounts.
What it is good for
Solo builders who want to stop paying for cloud login providers like Auth0 or AWS Cognito as their user numbers grow. It removes the need to write custom security code for cookies, password resets, and token refreshes.
- No user limits or per-user pricing, so your bills do not spike when you grow.
- You keep 100% of your user data in your own database, avoiding vendor lock-in.
- Supports email and password login, passwordless links, social logins, and multi-factor authentication out of the box.
- Requires running a persistent Java-based HTTP service alongside your own web application server.
- Setup difficulty is medium to high, as you need to configure both the core service and the matching software development kit in your app code.
- Custom licence terms apply to parts of the repository, so check the details if you plan to resell it.
Auth0 or AWS Cognito
PostgreSQL
- authelia/authelia29k stars
Protects your applications with single sign-on, but acts more like a gateway proxy rather than an app login library.
- zitadel/zitadel15k stars
Provides user management and identity services in Go, designed for larger enterprise deployments.
- ory/kratos14k stars
Offers identity management and user login workflows, but has a steeper configuration curve.
- future-architect/vuls12k stars
Scans Linux machines over SSH for installed software with publicly reported security holes.
- cossacklabs/acra1.5k stars
A proxy that encrypts individual database fields on the way in and decrypts them on the way out.
- 0xERR0R/blocky7.0k stars
A small DNS service for a home or office network that refuses to look up advertising and tracking addresses.
docker run -p 3567:3567 -d --name supertokens supertokens/supertokens-postgresql