Skip to content
inetGeek

Stytch vs SuperTokens

SEPT 2026 audit

A comparison of Stytch and SuperTokens built from values read directly from each provider's own documentation, with the source recorded against every figure.

Reviewed by Palash BagchiUpdated 24 criteria comparedSources last checked

The short answer

Choose Stytch if…

B2B products selling to several SSO-using customers early — five connections free is the difference between paying per logo and not paying at all.

Editorial · Palash Bagchi · approved

Choose SuperTokens if…

Teams that want to run auth themselves and keep the user table in their own database, with a managed option priced per user rather than per plan.

Editorial · Palash Bagchi · approved

Consider something else if…

  • Stytch: There is no flat plan to budget against: everything above the free allowances is metered, so the bill tracks usage rather than a number you agreed to.
  • SuperTokens: The $100 monthly minimum makes it expensive below about 5,000 users, and MFA is a separate per-user charge rather than an included feature.

Neither quite fits? Every other option, ranked by iScore: Stytch alternatives · SuperTokens alternatives

10 sourced criteria separate them — see where, with sources, below.

Visit Stytch documentationVisit SuperTokens documentation

No affiliate links, sponsored placements or paid rankings appear on this site. Ordering follows the sourced data and the stated criteria.

01.

At a glance.

CriterionStytchSuperTokens
Pricing
Free tierYesYes
Kind of free offerAlways freeAlways free
What the free plan includes10,000 monthly active users, 5 SSO or SCIM connections, 1,000 machine-to-machine tokens and 10,000 fingerprints; usage beyond that is billed at list rates.The open-source features are free at any scale when self-hosted, with no user cap; only the paid add-ons and the managed service are billed. The managed dashboard is free for the first three users.
Entry paid planNo priced paid plan: Pay as you go starts at $0/month and meters usage above the free allowances; the only other tier, Enterprise, is quoted "Custom".$100 per month minimum billing on the managed Cloud service; anything from 1 to 4,999 MAU bills at that $100 floor.
Pricing modelPay as you go with no platform fee: usage above the always-free allowances is metered, and the estimator on the page prices monthly active users, SSO connections, SCIM connections and M2M tokens as separate lines.Per monthly active user with add-ons metered on top rather than bundled: $0.02 per MAU base, plus $0.01 per MAU for multi-factor auth, plus $0.005 per MAU for account linking, plus $20 per dashboard user per month beyond the 3 free ones — all against a $100/month minimum on the managed Cloud plan. Self-hosting the open source features is free with no MAU limit.
Infrastructure
RegionsUnited States only — Stytch runs exclusively on U.S. servers, so strict in-region data localization is not possible.Attack Protection Suite calls go to one of three published regional endpoints: US (N. Virginia), EU (Ireland) and APAC (Singapore). Attack Protection Suite endpoints only; the managed core's own region list is not enumerated on the site.
Auth
Users included
10,000 monthly active users free, permanently, alongside unlimited organizations and 1,000 M2M tokens.
No fixed allowance — billing is $0.02 per monthly active user against a $100 monthly minimum, so the first 4,999 users are covered by the floor.
SCIM provisioning
Supported
Not supported — Not shipped; the post shows how to build SCIM endpoints on top of SuperTokens yourself.
Multi-factor authenticationSupportedSupported
Compliance
SOC 2SOC 2 Type 2, covering all Services, which the document defines as including the cloud-based identity platform branded Stytch. Stytch's own docs point to the Twilio Trust Center for the Stytch-named SOC 2 report.Advertised as SOC2 compliant with 100+ controls and tests; the site does not state the audit type (Type I or II) or report availability.
GDPR / data residency
GDPR compliance via a DPA with Standard Contractual Clauses and EU/UK/Swiss Data Privacy Framework self-certification; data sits on U.S. servers only.
Listed as compliant on "Compliance (SOC2, GDPR)" in the pricing page's own comparison table (SuperTokens column: Yes). A self-comparison table; no data-residency or EU-hosting option is given there.
Encryption at restCustomer Data is encrypted at rest in AWS and GCP using the Advanced Encryption Standard. Scope: all Twilio Services, which the same document defines as including Stytch.Trust centre control "Data encryption utilized": datastores housing sensitive customer data are encrypted at rest.
Role-based access control
Five dashboard roles — Admin, Developer, Support Manager, Support Agent and No Access — each with a published per-permission matrix. Stytch's own dashboard roles; RBAC for your end users is a separate product feature.
Built-in User Roles feature: create roles and permissions, assign them to users and limit access based on application logic.

Only criteria both providers publish appear here; a tinted cell marks a real difference. Criteria only one of them documents are listed below, and an absence there means we found no source — not that the feature is missing. How we source this.

The small bar above a value is inetGeek's own lean toward that side — computed from the same facts shown, never a number the provider published. See the picker below "The short answer" to weigh only the criteria you care about.

02.

Where they differ.

What the free plan includes

Stytch
10,000 monthly active users, 5 SSO or SCIM connections, 1,000 machine-to-machine tokens and 10,000 fingerprints; usage beyond that is billed at list rates.
SuperTokens
The open-source features are free at any scale when self-hosted, with no user cap; only the paid add-ons and the managed service are billed. The managed dashboard is free for the first three users.
Sources (2) →
  • Stytch Pricing ↗

    “If you surpass the 10,000 MAUs, 5 SSO or SCIM connections, 1000 M2M tokens, or 10,000 fingerprints included in our free tier, you'll pay for only what you use at the rates outlined above.”

    Read 2026-09-13 · official pricing · Report a correction

  • SuperTokens Pricing ↗

    “In self hosted, you can use the open source features of SuperTokens for free at any scale and pay only for the paid features mentioned in "Scale". [...] free for first 3 users”

    Read 2026-09-13 · official pricing · Report a correction

Entry paid plan

Stytch
No priced paid plan: Pay as you go starts at $0/month and meters usage above the free allowances; the only other tier, Enterprise, is quoted "Custom".
SuperTokens
$100 per month minimum billing on the managed Cloud service; anything from 1 to 4,999 MAU bills at that $100 floor.
Sources (2) →

Pricing model

Stytch
Pay as you go with no platform fee: usage above the always-free allowances is metered, and the estimator on the page prices monthly active users, SSO connections, SCIM connections and M2M tokens as separate lines.
SuperTokens
Per monthly active user with add-ons metered on top rather than bundled: $0.02 per MAU base, plus $0.01 per MAU for multi-factor auth, plus $0.005 per MAU for account linking, plus $20 per dashboard user per month beyond the 3 free ones — all against a $100/month minimum on the managed Cloud plan. Self-hosting the open source features is free with no MAU limit.
Sources (2) →
  • Pricing — Stytch ↗

    “Pay as you go Starting at: $0 / Month [...] Monthly active users : SSO Connections SSO SCIM Connections SCIM M2M Tokens M2M Optional add ons”

    Read 2026-09-06 · official pricing · Report a correction

  • Pricing & Features for SuperTokens ↗

    “Cloud Self-hosted $0.02 per MAU [...] Multi-factor Authentication $0.01 / MAU [...] Account Linking $0.005 / MAU [...] Number of Dashboard users (3 free users) $20 / user / month”

    Read 2026-09-13 · official pricing · Report a correction

Regions

Stytch
United States only — Stytch runs exclusively on U.S. servers, so strict in-region data localization is not possible.
SuperTokens
Attack Protection Suite calls go to one of three published regional endpoints: US (N. Virginia), EU (Ireland) and APAC (Singapore). Attack Protection Suite endpoints only; the managed core's own region list is not enumerated on the site.
Sources (2) →

Users included

Stytch

10,000 monthly active users free, permanently, alongside unlimited organizations and 1,000 M2M tokens.

SuperTokens

No fixed allowance — billing is $0.02 per monthly active user against a $100 monthly minimum, so the first 4,999 users are covered by the floor.

Sources (2) →
  • Pricing — Stytch ↗

    “Always free: 10,000 monthly active users and AI agents Unlimited Organizations 5 SSO or SCIM Connections 1,000 M2M Tokens”

    Read 2026-09-06 · official pricing · Report a correction

  • Pricing — SuperTokens ↗

    “$0.02 per MAU Number of unique logged in users that are on your prod [...] if you have 5,000 MAUs, that will be ( $0.02 + $0.005 ) * 5000 = $125”

    Read 2026-09-06 · official pricing · Report a correction

SCIM provisioning

Stytch
Supported
SuperTokens
Not supported — Not shipped; the post shows how to build SCIM endpoints on top of SuperTokens yourself.
Sources (2) →

SOC 2

Stytch
SOC 2 Type 2, covering all Services, which the document defines as including the cloud-based identity platform branded Stytch. Stytch's own docs point to the Twilio Trust Center for the Stytch-named SOC 2 report.
SuperTokens
Advertised as SOC2 compliant with 100+ controls and tests; the site does not state the audit type (Type I or II) or report availability.
Sources (2) →
  • Twilio Security Overview ↗

    “Certification or Attestation Covered Services ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018 Twilio Services, Segment Services SOC 2 Type 2 All Services [...] means any (a) services or application programming interfaces branded as “Twilio” and (b) cloud-based identity, authentication, and security platform, and related services, branded as “Stytch”.”

    Read 2026-09-13 · official site · Report a correction

  • SuperTokens - Modular User Management Suite ↗

    “SOC2 100+ controls and tests.”

    Read 2026-09-13 · official site · Report a correction

GDPR / data residency

Stytch
GDPR compliance via a DPA with Standard Contractual Clauses and EU/UK/Swiss Data Privacy Framework self-certification; data sits on U.S. servers only.
SuperTokens
Listed as compliant on "Compliance (SOC2, GDPR)" in the pricing page's own comparison table (SuperTokens column: Yes). A self-comparison table; no data-residency or EU-hosting option is given there.
Sources (2) →
  • Data compliance — Stytch Docs ↗

    “Data Processing Agreement (DPA) : We offer a DPA that incorporates Standard Contractual Clauses (SCCs) for lawful cross-border data transfers. [...] Stytch self-certifies compliance with the Data Privacy Framework requirements for data transfers from the EU, United Kingdom, and Switzerland to the United States. [...] Because Stytch operates exclusively out of U.S. servers, achieving this level of rigid localization with their service is not possible.”

    Read 2026-09-13 · official docs · Report a correction

  • Pricing & Features for SuperTokens ↗

    “Supertokens Auth0 AWS Cognito Keycloak Firebase [...] Compliance (SOC2, GDPR) Yes Yes Yes Self hosted - so not required Yes”

    Read 2026-09-13 · official pricing · Report a correction

Encryption at rest

Stytch
Customer Data is encrypted at rest in AWS and GCP using the Advanced Encryption Standard. Scope: all Twilio Services, which the same document defines as including Stytch.
SuperTokens
Trust centre control "Data encryption utilized": datastores housing sensitive customer data are encrypted at rest.
Sources (2) →

Role-based access control

Stytch
Five dashboard roles — Admin, Developer, Support Manager, Support Agent and No Access — each with a published per-permission matrix. Stytch's own dashboard roles; RBAC for your end users is a separate product feature.
SuperTokens
Built-in User Roles feature: create roles and permissions, assign them to users and limit access based on application logic.
Sources (2) →
  • Dashboard Roles and Permissions — Stytch Docs ↗

    “Stytch offers the following user roles in our dashboard: Admin: Able to perform all actions across the Dashboard, including managing Live API Keys. [...] Support Agent: Read access to project Users, Members, Organizations and event logs.”

    Read 2026-09-13 · official docs · Report a correction

  • Introduction - SuperTokens Docs ↗

    “SuperTokens provides a way to set different levels of authorization control through the User Roles feature. With it, you can create roles and permissions, assign them to your users and limit access based on your application logic.”

    Read 2026-09-13 · official docs · Report a correction

When these numbers change, hear about it. Sources are re-checked monthly; a repricing goes out as a short note.

Confirm by email; unsubscribe from any issue. Your address goes to Kit and nowhere else — what we do with it.

03.

Documented by only one.

These criteria are published by one provider and not the other. An absence here means we have not found a source, not that the feature is missing — except where we say we read the other provider's own page on a given date and it does not state it. Those rows lean, and the provider can correct them with a link.

Uptime SLAStytch: 99.99% on Enterprise, which is custom-priced. The self-serve plans publish no uptime commitment.
Self-hostableSuperTokens: Supported
Price per SSO connectionStytch: Five SSO or SCIM connections included free. Clerk includes one and charges $75 for each additional; WorkOS charges $125 each from the first.
SAML single sign-onStytch: Supported
Audit logsStytch: Event logs cover API requests and dashboard admin actions, are visible in the Dashboard and retained 30 days; longer retention means streaming to Datadog Logs or Grafana Loki, the only supported destinations.
Support on entry paid planStytch: Enterprise bundles an enterprise support SLA, a private support Slack channel and migration support. Below it the page offers a dev success team to contact, and names no tier.
ISO 27001Stytch: ISO/IEC 27001, ISO/IEC 27017 and ISO/IEC 27018 certified for the Twilio Services, defined to include the identity platform branded Stytch. Stytch's docs list an ISO 27001 certification among Stytch's own compliance documents.
HIPAAStytch: HIPAA/BAA is listed only under Enterprise, which is custom-priced; the Pay as you go tier does not list it.
PCI DSSStytch: PCI SAQ-A covers the Stytch identity platform; PCI DSS Level 1 applies only to services named in Twilio's PCI DSS Responsibility Matrix.
Private networking / VPCSuperTokens: Self-hosted only: docs say to run the Core and PostgreSQL on private networks, or a subnet reachable only by your own backend. Self-host deployment guidance, not a managed-service private-link or VPC-peering offering.
Dedicated infrastructureStytch: Multi-tenant: the production environment is shared and logically isolated in a VPC, with Customer Data segregated by unique per-customer identifiers. Scope: all Twilio Services, which the document defines as including Stytch.
04.

Questions this comparison answers.

Entry paid plan: Stytch or SuperTokens?

Stytch: No priced paid plan: Pay as you go starts at $0/month and meters usage above the free allowances; the only other tier, Enterprise, is quoted "Custom".

SuperTokens: $100 per month minimum billing on the managed Cloud service; anything from 1 to 4,999 MAU bills at that $100 floor.

Should I choose Stytch or SuperTokens?

Pick Stytch if B2B products selling to several SSO-using customers early — five connections free is the difference between paying per logo and not paying at all.

Pick SuperTokens if Teams that want to run auth themselves and keep the user table in their own database, with a managed option priced per user rather than per plan.

Provider pages

StytchPay-as-you-go auth for B2B and consumer apps, with five SSO or SCIM connections included free — the most generous enterprise allowance in this set.SuperTokensOpen-source auth billed per monthly active user, with MFA and account linking metered separately and a self-hosted option.

Related comparisons

Auth0 vs StytchAuth0 vs SuperTokensBetter Auth vs StytchBetter Auth vs SuperTokensKinde vs StytchKinde vs SuperTokensStytch vs ClerkStytch vs WorkOS

Comments

Every page here is sourced and dated.