supertokens-core: Build Authentication Into Your Applications

Overview

SuperTokens Core is the Java HTTP service behind SuperTokens, an authentication system that applications connect to through frontend and backend SDKs. It handles core authentication logic and database operations, while SDKs provide application-facing APIs and manage client sessions.

It is aimed at teams that want to add authentication without building the underlying flows themselves, and prefer the option to deploy the service with their own database. The repository is the core service, not a standalone frontend login UI or a drop-in SDK for every application language.

Key Features

• Supports passwordless, social, email-password, and phone-password login flows.
• Provides session management, including session refresh operations through backend SDKs.
• Includes multi-factor authentication and multi-tenancy or organization support.
• Offers user roles and microservice authentication capabilities.
• Separates frontend SDKs, backend SDKs, and the core service so teams can integrate the parts they need.
• Supports on-premises deployment with user data stored in the operator's database.

Use Cases

• Product teams adding sign-up, sign-in, and session handling without implementing authentication logic from scratch.
• Organizations that need to keep authentication data within their own deployment and database.
• Applications that want passwordless, social, or password-based login options through supported SDKs.
• Teams seeking session management integrations alongside another login provider, as described by the project.
• Services that need authentication features such as roles, multi-factor authentication, or tenant support.

Getting Started

The README points to the SuperTokens guides for setup and the build-from-source wiki for compiling the core. Start with the repository README to choose an integration path and deployment method.

Considerations

• The core service is one part of a system: application integration also involves frontend and backend SDKs.
• The README notes that session verification commonly happens in backend SDKs rather than contacting the Java core, so SDK compatibility and deployment design matter.
• Building from source requires following separate wiki instructions; the provided input does not specify a one-command installation procedure.
• The repository reports its license as NOASSERTION. Its README describes Apache 2.0 licensing for content outside specified exceptions, and separate licensing for the ee/ directory if present. Review the repository license files for the terms that apply to your use.