Introduction

Add secure, customizable authentication and session management to your applications with SuperTokens.

SuperTokens is an open-source authentication provider that gives you control over your user data and login experience. Use the managed service or self-host the SuperTokens Core, then integrate authentication through frontend and backend SDKs.

[Quickstart

Integrate SuperTokens into an existing application.](/content/docs/quickstart/index.html) [Migration

Replace an existing authentication provider with SuperTokens.](/content/docs/migration/overview/index.html)

How SuperTokens works

The SuperTokens Core provides the authentication functionality. Your backend SDK communicates with the Core to perform authentication tasks, while the frontend SDK sends requests to authentication routes exposed by your backend.

Unlike many authentication providers, the frontend SDK never communicates with the authentication service directly. This lets your application control the API layer, customize authentication behavior, and keep the Core inside your infrastructure when self-hosting.

Managed service Self-hosted

Recipes

SuperTokens groups functionalities, like authentication methods or session and user management actions, into recipes. Each can be used as extendable building blocks which allow you to customize the authentication experience based on your needs.

Explore capabilities

[Email/password authentication

Let users sign up and sign in with an email and password, with customizable forms and password reset flows.](/content/docs/authentication/email-password/introduction/index.html) [Passwordless authentication

Authenticate users with one-time passwords or magic links sent by email or SMS.](/content/docs/authentication/passwordless/introduction/index.html) [Social login

Let users sign in with Google, Apple, GitHub, and other identity providers.](/content/docs/authentication/social/introduction/index.html) [Passkeys

Offer phishing-resistant sign-in using biometrics, device PINs, or security keys.](/content/docs/authentication/passkeys/introduction/index.html) [Unified login

Authenticate users across web, mobile, and desktop applications through a common OAuth2 provider.](/content/docs/authentication/unified-login/introduction/index.html) [Machine-to-machine authentication

Secure service-to-service requests with access tokens using the OAuth2 client credentials flow.](/content/docs/authentication/m2m/introduction/index.html) [Multi-factor authentication

Add email or SMS OTP, TOTP, or passkeys as factors, with step-up authentication for sensitive actions.](/content/docs/additional-verification/mfa/introduction/index.html) [Attack Protection Suite

Detect risky authentication activity and respond with extra verification or blocked attempts.](/content/docs/additional-verification/attack-protection-suite/introduction/index.html) [Enterprise login and multitenancy

Configure tenant-specific login methods, isolated user pools, and enterprise SSO.](/content/docs/authentication/enterprise/introduction/index.html)

Next steps

[Choose an authentication method

Configure the sign-in methods that fit your application.](/content/docs/authentication/overview/index.html) [Manage users and sessions

Protect routes, manage sessions, and work with authenticated users.](/content/docs/post-authentication/session-management/introduction/index.html) [Integrate with AI

Give an AI coding agent the context it needs to integrate SuperTokens.](/content/docs/integrate-with-ai/index.html) [Deploy SuperTokens

Use the managed service or deploy the SuperTokens Core yourself.](/content/docs/deployment/self-host-supertokens/index.html)