Okta → Supertokens

Okta Workforce Identity is sold as a set of staff-facing products: single sign-on, MFA, a universal directory, lifecycle management and access governance. SuperTokens addresses a different job. Its repository describes it as an open-source alternative to Auth0, Firebase Auth and AWS Cognito, meaning code that lets a developer add sign-in to an application they own. Anyone comparing the two should first decide whether they need an employee directory or customer sign-in.

What Okta costs

Okta lists Starter at $6, Core Essentials at $14 and Essentials at $17 per user per month for Workforce Identity, with Professional and Enterprise on inquiry. Billing is annual and the page states a $1,500 annual contract minimum. Its Customer Identity Enterprise base platform is listed at $3K per month billed annually, and the B2C and B2B suites are quoted individually.

What SuperTokens costs

The SuperTokens pricing page offers two deployment options. Self-hosting the open-source features is free, with the page stating no limits. The managed cloud is $0.02 per monthly active user and free under 5K users. Extras are priced separately: multi-factor authentication at $0.01 per user and account linking at $0.005 per user, each with a $100 monthly minimum; dashboard users are free for three and then $20 per user per month. Multi-tenancy, the route to enterprise SSO, shows only “See pricing,” and several items, including machine-to-machine authentication and uptime SLAs, say to contact the company. The page’s worked examples are not easy to reconcile with the free tier, so confirm the bill with the vendor before budgeting.

What the switch changes

Okta runs as a service that applications redirect to. SuperTokens puts an SDK into your own backend, which talks to a separate core service that holds the data. The core is written in Java, and SDKs exist for languages including Node.js, Go and Python. The free features listed include email and password, social and SSO providers, magic links, one-time passcodes, role-based access control and session management. SuperTokens’ documentation does not describe equivalents to Okta’s lifecycle automation or access governance, so a team relying on those would need other tools.

What migration involves

SuperTokens documents migration in two steps. Account migration moves users and credentials from the old provider, and session migration lets users who signed in through the old provider get SuperTokens sessions without logging in again. The documentation says to keep using the legacy provider until every step is implemented.

For accounts, the bulk import endpoint takes up to 10,000 users per request and a background job processes staged users every 5 minutes. It needs Core 10.0.0 or later and a persistent database. Email and password users need either a supported hash with its algorithm name or a plain-text password, and the page recommends bcrypt, Argon2 or Firebase scrypt hashes. That is awkward for Okta, whose Users API documentation shows an existing password as an empty object and whose support article restricts hash export to very limited cases moving to Auth0. Plan for resets unless Okta agrees otherwise. SuperTokens’ migration documentation does not cover importing TOTP secrets, so authenticator enrolments likely have to be repeated.

Migration checklist

• Decide whether the use case is customer sign-in; if it is staff access, keep that part elsewhere.
• Configure tenants, roles, recipes and providers in SuperTokens before importing.
• Export users through the Okta API, and ask Okta whether a hash export applies to you.
• Import in staged batches and review failed rows.
• Create users from the old sign-up flow during the transition so no one is missed.
• Rewrite session checks, then keep Okta available as a fallback after cutover.