# SuperTokens

Canonical: https://inetgeek.com/auth/supertokens/

Open-source auth billed per monthly active user, with MFA and account linking metered separately and a self-hosted option.

## Who it suits

Teams that want to run auth themselves and keep the user table in their own database, with a managed option priced per user rather than per plan.

Consider something else if The $100 monthly minimum makes it expensive below about 5,000 users, and MFA is a separate per-user charge rather than an included feature.

## Adoption signals

- Open source: supertokens/supertokens-core — 15,297 stars, 843 forks (GitHub, checked 2026-09-12)

## iScore

72 / 100 (80% interval 69–76), rank 8 of 8 in auth — interval overlaps the next rank, so this is an ordering, not a finding.

inetGeek's own reading, computed from sourced facts against category peers by disclosed rules. Not a provider claim. Intervals are 80%; a provider with few documented facts is pulled toward the category middle rather than scored on what little is known.
Read this score with care:
- Trust and compliance is thin: 6 of 15 criteria are scored, so it sits near the category middle with a wide interval (72–85). Read the interval, not the point.
- Documented but not scored, because the page states it as text with no comparable number or a yes/limited/no (a one-time, usage-based or other-vendor price, or a per-site choice): free_allowance. Read them on the provider page; the score neither rewards nor penalises what it could not compare.

Method: https://inetgeek.com/iscore/. Full output with every criterion's basis: https://inetgeek.com/scores.json. Every auth peer ranked: https://inetgeek.com/auth/supertokens/alternatives/

- Price: 76 (70–83), weight 32%, 3 of 6 criteria scored; scored for peers, not here — undocumented or stated without a number or a yes/limited/no: free_allowance, free_card_required, sso_connection_price
- Capacity and limits: 41 (20–63), weight 5%, 1 of 1 criteria scored
- Capabilities: 86 (79–92), weight 13%, 2 of 2 criteria scored
- Trust and compliance: 78 (72–85), weight 32%, 6 of 15 criteria scored; scored for peers, not here — undocumented or stated without a number or a yes/limited/no: audit_logs, customer_managed_keys, dedicated_infrastructure, hipaa_eligible, iso27001, pci_dss, sso_saml, support_included, uptime_sla
- Evidence: 84 (84–84), weight 10%, 4 of 4 criteria scored
- Adoption: 25 (15–35), weight 10%, 1 of 2 criteria scored

## What the documentation says

### Pricing

- Free tier: Yes ([source](https://supertokens.com/pricing), read 2026-09-13)
- Kind of free offer: Always free ([source](https://supertokens.com/pricing), read 2026-09-13)
- What the free plan includes: The open-source features are free at any scale when self-hosted, with no user cap; only the paid add-ons and the managed service are billed. The managed dashboard is free for the first three users. ([source](https://supertokens.com/pricing), read 2026-09-13)
- Entry paid plan: $100 per month minimum billing on the managed Cloud service; anything from 1 to 4,999 MAU bills at that $100 floor. ([source](https://supertokens.com/pricing), read 2026-09-13)
- Pricing model: Per monthly active user with add-ons metered on top rather than bundled: $0.02 per MAU base, plus $0.01 per MAU for multi-factor auth, plus $0.005 per MAU for account linking, plus $20 per dashboard user per month beyond the 3 free ones — all against a $100/month minimum on the managed Cloud plan. Self-hosting the open source features is free with no MAU limit. ([source](https://supertokens.com/pricing), read 2026-09-13)

### Infrastructure

- Regions: Attack Protection Suite calls go to one of three published regional endpoints: US (N. Virginia), EU (Ireland) and APAC (Singapore). Attack Protection Suite endpoints only; the managed core's own region list is not enumerated on the site. ([source](https://supertokens.com/docs/additional-verification/attack-protection-suite/initial-setup), read 2026-09-13)

### Observability

- Self-hostable: Supported ([source](https://supertokens.com/pricing), read 2026-09-06)

### Auth

- Users included: No fixed allowance — billing is $0.02 per monthly active user against a $100 monthly minimum, so the first 4,999 users are covered by the floor. ([source](https://supertokens.com/pricing), read 2026-09-06)
- SCIM provisioning: Not supported — Not shipped; the post shows how to build SCIM endpoints on top of SuperTokens yourself. ([source](https://supertokens.com/blog/scim-provisioning-explained), read 2026-09-13)
- Multi-factor authentication: Supported ([source](https://supertokens.com/pricing), read 2026-09-06)

### Compliance

- SOC 2: Advertised as SOC2 compliant with 100+ controls and tests; the site does not state the audit type (Type I or II) or report availability. ([source](https://supertokens.com/product), read 2026-09-13)
- GDPR / data residency: Listed as compliant on "Compliance (SOC2, GDPR)" in the pricing page's own comparison table (SuperTokens column: Yes). A self-comparison table; no data-residency or EU-hosting option is given there. ([source](https://supertokens.com/pricing), read 2026-09-13)
- Encryption at rest: Trust centre control "Data encryption utilized": datastores housing sensitive customer data are encrypted at rest. ([source](https://security.supertokens.com/controls), read 2026-09-13)
- Role-based access control: Built-in User Roles feature: create roles and permissions, assign them to users and limit access based on application logic. ([source](https://supertokens.com/docs/additional-verification/user-roles/introduction), read 2026-09-13)
- Private networking / VPC: Self-hosted only: docs say to run the Core and PostgreSQL on private networks, or a subnet reachable only by your own backend. Self-host deployment guidance, not a managed-service private-link or VPC-peering offering. ([source](https://supertokens.com/docs/deployment/self-host-supertokens), read 2026-09-13)

## Compared with

- [SuperTokens vs Clerk](https://inetgeek.com/compare/supertokens-vs-clerk/)
- [SuperTokens vs Auth0](https://inetgeek.com/compare/auth0-vs-supertokens/)
- [SuperTokens vs Better Auth](https://inetgeek.com/compare/better-auth-vs-supertokens/)
- [SuperTokens vs Kinde](https://inetgeek.com/compare/kinde-vs-supertokens/)
- [SuperTokens vs Stytch](https://inetgeek.com/compare/stytch-vs-supertokens/)
- [SuperTokens vs WorkOS](https://inetgeek.com/compare/supertokens-vs-workos/)