Analytics cookies only (Google Analytics, PostHog). No ad networks, no cross-site tracking. See our privacy policy.
An open-core login provider: the core is a Java service with an HTTP API for sessions, email and password, passwordless and social login, roles and multi-tenancy, which your own backend calls through SuperTokens SDKs while your frontend uses prebuilt sign-in UI. Apache-2.0 outside its `ee/` directory, which is under an enterprise license; this image keeps its data in PostgreSQL.
Runs on a VPS from $6/mo (Kamatera 2GB, 2 GB RAM) · prices checked Sep 2026
Pick SuperTokens when you are building an application and want the login system inside it rather than a separate identity server your users see. The README positions it as an open-core alternative to proprietary login providers like Auth0 or AWS Cognito: the core handles users, sessions and roles over an API, and SDKs in your backend and frontend give you the sign-in flows, so the screens look like your product. That makes it the opposite of the catalog's Keycloak, Zitadel and authentik, which are standalone identity servers with their own login pages and admin consoles. Our snippet is a two-container Compose file, the core image for PostgreSQL and a PostgreSQL 16 database, with the image pinned to a release tag and the database password generated for you. We did not find an upstream RAM minimum, so our 512 MB floor is an estimate.
Paid link — we earn a commission if you shop through it.
Run these commands on your server:
# SuperTokens — login and session core with PostgreSQL — based on the project's Docker image, pinned to 12.4.1
echo "DB_PASSWORD=$(openssl rand -hex 16)" > .env
cat > docker-compose.yml <<'EOF'
services:
supertokens:
image: supertokens/supertokens-postgresql:12.4.1
restart: unless-stopped
depends_on:
db:
condition: service_healthy
environment:
POSTGRESQL_CONNECTION_URI: postgresql://supertokens:${DB_PASSWORD}@db:5432/supertokens
ports:
- 3567:3567
db:
image: postgres:16
restart: unless-stopped
environment:
POSTGRES_USER: supertokens
POSTGRES_PASSWORD: ${DB_PASSWORD}
POSTGRES_DB: supertokens
volumes:
- db_data:/var/lib/postgresql/data
healthcheck:
test: ["CMD-SHELL", "pg_isready -U supertokens -d supertokens"]
interval: 5s
timeout: 5s
retries: 10
volumes:
db_data:
EOF
docker compose up -d
timeout 120 bash -c 'until curl -fsS http://localhost:3567/hello >/dev/null; do sleep 5; done'
# → http://SERVER_IP:3567/hello — the core is an API for your backend, not a sign-in pageSuperTokens's README, license files and config reference flag these before you build on it: