Auth0 → Supertokens

Auth0 is a hosted identity platform that handles sign-up, login, social connections, multi-factor authentication and enterprise single sign-on for an application. SuperTokens is an open-core authentication product: the core server is published on GitHub, where the repository states that content outside its ee/ directory is available under the Apache 2.0 licence, and it can also be used as a managed cloud service.

What Auth0 costs today

Auth0 lists a Free plan at $0 per month for up to 25,000 monthly active users, with no credit card needed. Paid plans are split into B2C and B2B. On the B2C side, Essentials starts at $35 per month for 500 users and Professional at $240 per month for 500 users. On the B2B side, Essentials starts at $150 per month and Professional at $800 per month, also for 500 users. Prices rise with usage: B2C Essentials is $70 per month at 1,000 users, and B2B Professional is $1,200 per month at 2,500 users. Yearly billing is listed as 11 times the monthly price. Enterprise pricing is available only by contacting sales.

What SuperTokens costs

The self-hosted option is listed as free and open source with no cap on monthly active users. The managed cloud service is listed at $0.02 per user per month, with a free tier under 5,000 users. Several features are priced as cloud add-ons: multi-factor authentication at $0.01 per user with a $100 monthly minimum, and account linking at $0.005 per user with a $100 monthly minimum. Multi-tenancy, which the documentation describes as covering enterprise SAML login, is marked as a paid feature, and the pricing page gives no figure for it. The page also lists worked examples, including $100 per month for 1 to 4,999 users, which reads awkwardly beside the free tier line, so the pricing page is worth rechecking before budgeting.

What changes in the switch

With Auth0, login is handled largely by a hosted service that the application redirects to. With SuperTokens, a backend SDK runs inside the application’s own server, and the core service sits behind it. Backend SDKs exist for Node.js, Go and Python, and the frontend options include a prebuilt React UI plus web, React Native, Android, iOS and Flutter libraries. Sessions use access and refresh tokens, stored in HTTP-only cookies by default on the web, with header-based tokens as an alternative and as the mobile default. Code that reads Auth0 tokens or claims needs reworking against this model.

The trade-offs sit in the same place as the benefits. Keeping authentication in the application’s own stack gives control over data and removes per-user pricing for self-hosters, but it means more code and more operational work on the team’s side, including running and upgrading the core if it is self-hosted. SuperTokens is also a smaller company than Auth0, and the paid enterprise features, such as SAML through multi-tenancy, are not as turnkey as a mature enterprise plan.

Migration checklist

• Set up SuperTokens and configure tenants, roles, recipes and third-party providers before importing anything. Bulk import needs Core 10.0.0 or later and a persistent database.
• Export users from Auth0 through the Management API or the import and export extension. The SuperTokens documentation states that Auth0 does not expose password hashes or TOTP device information, so these must be requested from Auth0 support separately.
• Prefer bcrypt, Argon2 or Firebase scrypt hashes for email and password users. Users without a usable hash will need a password reset.
• Bulk import accepts up to 10,000 users per request, and staged users are processed by a job that runs every 5 minutes. Check for failed rows and fix them before re-staging.
• Decide on lazy migration for users who sign in during the transition, with bulk import covering inactive accounts.
• Plan for users to sign in again, since existing Auth0 sessions are not described as carrying over, and keep the Auth0 fallback for some time after cutover.

Other options

Teams weighing an open-source move may also look at Keycloak, Zitadel or Hanko, which are not reviewed here.