# Introduction

Add secure, customizable authentication and session management to your applications with SuperTokens.

SuperTokens is an open-source authentication provider that gives you control over your user data and login experience. Use the managed service or self-host the SuperTokens Core, then integrate authentication through frontend and backend SDKs.

[Quickstart\
\
Integrate SuperTokens into an existing application.](/content/docs/quickstart/index.html) [Migration\
\
Replace an existing authentication provider with SuperTokens.](/content/docs/migration/overview/index.html)

## [How SuperTokens works](/content/docs#how-supertokens-works/index.html)

The **SuperTokens Core** provides the authentication functionality. Your backend SDK communicates with the Core to perform authentication tasks, while the frontend SDK sends requests to authentication routes exposed by your backend.

Unlike many authentication providers, the frontend SDK never communicates with the authentication service directly. This lets your application control the API layer, customize authentication behavior, and keep the Core inside your infrastructure when self-hosting.

Managed service Self-hosted

### [Recipes](/content/docs#recipes/index.html)

SuperTokens groups functionalities, like authentication methods or session and user management actions, into **recipes**. Each can be used as extendable building blocks which allow you to customize the authentication experience based on your needs.

## [Explore capabilities](/content/docs#explore-capabilities/index.html)

[Email/password authentication\
\
Let users sign up and sign in with an email and password, with customizable forms and password reset flows.](/content/docs/authentication/email-password/introduction/index.html) [Passwordless authentication\
\
Authenticate users with one-time passwords or magic links sent by email or SMS.](/content/docs/authentication/passwordless/introduction/index.html) [Social login\
\
Let users sign in with Google, Apple, GitHub, and other identity providers.](/content/docs/authentication/social/introduction/index.html) [Passkeys\
\
Offer phishing-resistant sign-in using biometrics, device PINs, or security keys.](/content/docs/authentication/passkeys/introduction/index.html) [Unified login\
\
Authenticate users across web, mobile, and desktop applications through a common OAuth2 provider.](/content/docs/authentication/unified-login/introduction/index.html) [Machine-to-machine authentication\
\
Secure service-to-service requests with access tokens using the OAuth2 client credentials flow.](/content/docs/authentication/m2m/introduction/index.html) [Multi-factor authentication\
\
Add email or SMS OTP, TOTP, or passkeys as factors, with step-up authentication for sensitive actions.](/content/docs/additional-verification/mfa/introduction/index.html) [Attack Protection Suite\
\
Detect risky authentication activity and respond with extra verification or blocked attempts.](/content/docs/additional-verification/attack-protection-suite/introduction/index.html) [Enterprise login and multitenancy\
\
Configure tenant-specific login methods, isolated user pools, and enterprise SSO.](/content/docs/authentication/enterprise/introduction/index.html)

## [Next steps](/content/docs#next-steps/index.html)

[Choose an authentication method\
\
Configure the sign-in methods that fit your application.](/content/docs/authentication/overview/index.html) [Manage users and sessions\
\
Protect routes, manage sessions, and work with authenticated users.](/content/docs/post-authentication/session-management/introduction/index.html) [Integrate with AI\
\
Give an AI coding agent the context it needs to integrate SuperTokens.](/content/docs/integrate-with-ai/index.html) [Deploy SuperTokens\
\
Use the managed service or deploy the SuperTokens Core yourself.](/content/docs/deployment/self-host-supertokens/index.html)