# supertokens/supertokens-core

Open source alternative to Auth0 / Firebase Auth / AWS Cognito

Repository: https://github.com/supertokens/supertokens-core
Canonical: https://ross.abutalabs.com/products/supertokens-core
Homepage: https://supertokens.com
Language: Java
License: NOASSERTION
License Family: other
Topics: authentication, session-management, login, supertokens, java, signin, password, social-login, email-password, email-password-login, auth0, keycloak, firebase-auth, aws-cognito, passwordless, passwordless-authentication, passwordless-login, oauth, hacktoberfest
Last push: 2026-08-26T21:04:33+00:00

## Health v2 (maintenance only)
Score: 94/100 (v2, computed 2026-09-03T02:39:23.370411+00:00)
- activity 99, release rhythm 85, longevity 100
- inputs: {"age_days": 2432, "days_push": 7, "days_rel": 20, "gap_med": 0, "n_releases_24m": 70}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 15282, forks 848 (observed 2026-08-28T04:11:09.508965+00:00)

## What it is
SuperTokens Core is the open-source HTTP service at the heart of the SuperTokens authentication platform, handling core auth logic and database operations for login and session management. It works with frontend and backend SDKs to provide email-password, social login, passwordless, MFA, and multi-tenancy authentication.

## Use cases
- self-host an alternative to Auth0 or Firebase Auth
- add email-password and social login to my app
- implement passwordless login with magic links and OTPs
- manage user sessions securely across web and mobile
- add multi-tenancy and enterprise SSO to my SaaS
- implement multi-factor authentication for my users

## When to choose
- you want full control over user data by self-hosting authentication
- you need a drop-in replacement for Auth0, AWS Cognito, or Keycloak without per-MAU costs
- you want SDKs for popular stacks like Node.js, Go, Python, and React
- you need passwordless, social login, and session management out of the box

## When to avoid
- you prefer a fully managed hosted auth service with zero infrastructure
- you need enterprise features like SSO or MFA without paying for add-ons
- your stack has no SuperTokens SDK available

## Facets
- artifact type: service
- maturity: active
- function: auth
- domain: security, web-development, backend
- platform: self-hosted, jvm
- tags: authentication, oauth, passwordless, social-login, sso, multi-tenancy, session-management, auth0-alternative, docker, web-server

## Member repositories
- supertokens/supertokens-core (main) score 94

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:11:09.508965+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:06:23.676771+00:00, confidence not recorded.
  - readme: https://github.com/supertokens/supertokens-core (fetched 2026-08-28T04:11:09.508965+00:00, sha 477dcee9e03f)
  - homepage: https://supertokens.com (fetched 2026-08-29T08:05:49.242319+00:00, sha 340329023da5)
  - site_page: https://supertokens.com/features/passwordless-login (fetched 2026-08-29T08:05:49.260107+00:00, sha 5cc69590e542)
  - site_page: https://supertokens.com/about-us (fetched 2026-08-29T08:05:49.256241+00:00, sha 8e493ce56b86)
  - site_page: https://supertokens.com/features/email-magic-links (fetched 2026-08-29T08:05:49.258336+00:00, sha c5379816988b)
  - site_page: https://supertokens.com/features/social-login (fetched 2026-08-29T08:05:49.263193+00:00, sha 23bda334bec9)
  - site_page: https://supertokens.com/features/attack-protection-suite (fetched 2026-08-29T08:05:49.264793+00:00, sha 983144e22dcf)
  - site_page: https://supertokens.com/pricing (fetched 2026-08-29T08:05:49.251748+00:00, sha aae668df11f1)
- Data as of 2026-08-30T08:39:29.467469+00:00.