supertokens/supertokens-core

Features

• Stateless Session Authentication - The authentication service validates access tokens using cryptographic signatures without network round-trips to ensure low-latency authentication checks for every request.
• Multi-Tenant Data Management - Enables robust multi-tenant data isolation through logical or physical partitioning of user records and configuration.
• Self-Hosted Infrastructure - Enables self-hosted deployment of centralized authentication infrastructure to maintain full control over user data.
• Multi-Tenant Identity Management - Enables isolated authentication environments with unique login methods, user pools, and security policies per tenant.
• Passwordless Authentication - Provides secure passwordless authentication flows using email or phone number verification codes.
• Identity and Access Management - Provides a comprehensive suite for managing user accounts, roles, and secure authentication flows.
• Open-Source Authentication Platforms - Provides a self-hosted, open-source authentication service with session management and multi-factor authentication.
• Stateless Session Management - Implements stateless, claims-based session management using cryptographically signed tokens for distributed authorization.
• Authentication Flows - Executes core sign-up and sign-in flows by managing user credential submission and validation.
• Self-Hosted Deployments - Runs the authentication backend as a containerized service within your own infrastructure.
• Authentication Workflows - Provides pre-built forms and workflows for email and password-based user sign-in and registration.
• Email Authentication Strategies - Registers new accounts and validates credentials to establish secure user sessions for email-based authentication.
• Hardware Authentication - Verifies user identity using hardware security keys and biometric authenticators via WebAuthn.
• Providers - Supports secure user sign-in and registration using magic links, OTP codes, and WebAuthn passkeys.
• JWT Claim Validation - Confirms token authenticity and expiration using public keys to ensure stateless authorization.
• Multi-Tenant Authentication Services - Enables isolated user pools and tenant-specific login configurations for secure multi-tenant environments.
• OAuth Providers - Acts as an OAuth and OIDC provider to issue access tokens and manage authorization flows.
• Passkey Authentication - Integrates passwordless authentication using browser-based standards for biometric and hardware key login.
• Role-Based Access Control - Provides granular role-based access control to manage authorization levels and restrict access to protected resources.
• Multi-Tenant Authentication Configurations - The authentication service sets specific first and second factor requirements for individual tenants to allow customized login flows within a multi-tenant environment.
• API and Machine Authentication - Secures machine-to-machine communication by validating client credentials and issuing access tokens for authorized resource access.
• Multi-Factor Authentication Strategies - The authentication service requires users to complete a secondary verification step after initial login by tracking progress and validating completion before granting access.
• Conditional Enforcement - The authentication service requires additional verification steps like OTP based on user attributes, roles, or account-specific settings during the authentication flow.
• One-Time Passwords - Validates user identity by sending temporary codes to email or phone for entry during the login process.
• SAML Authentication - Integrates with external enterprise identity providers using the SAML protocol for single sign-on.
• Adaptive Security Policies - Provides adaptive authentication that dynamically adjusts security requirements based on real-time risk signals and user policies.
• Password Hashing Utilities - Encrypts user passwords using configurable hashing algorithms like Argon2 or BCrypt to maintain secure credential storage.
• Enterprise SSO Integrations - Integrates third-party social providers and enterprise SAML services for external account authentication.
• Social Login Integrations - Integrates third-party social identity providers directly into the login interface.
• Threat Detection - Analyzes login requests for bot activity, VPN usage, and brute-force attempts to block malicious access.
• Stateless Token Validation - Enables high-performance authorization by verifying access tokens locally using public keys.
• Authentication and Identity - Open-source authentication with prebuilt UI components.
• Security and Compliance - Open-source authentication and authorization service.
• Security And Privacy - Authentication and session management framework.
• Bot Blocking - Analyzes request patterns and behavioral indicators to block automated bot activity and credential stuffing.
• Authentication and Authorization - Facilitates secure web application authentication by exchanging authorization codes for access tokens via redirection.
• Magic Link - Supports passwordless authentication by sending secure, time-limited links to users for login.
• Brute Force Protections - Monitors sensitive action frequency to block brute-force attempts and prevent unauthorized account access.
• Pre-built Authentication Components - Renders pre-built login components that support multi-factor authentication and account switching.
• WebAuthn Registrations - Enables users to register hardware security keys and biometric authenticators for account access.
• Server-Side Session Stores - Enables immediate server-side session invalidation by removing records directly from the database.
• OAuth2 Providers - Configures the backend to act as an OAuth2 provider, exposing endpoints for authorization requests and token exchanges.
• Leaked Credential Checks - Prevents the use of compromised or insecure passwords by comparing them against databases of known leaked credentials.
• Requirement Policies - The authentication service defines which secondary authentication factors are mandatory for specific users or groups to secure access to sensitive accounts.
• OAuth2 Access Token Issuance - Facilitates secure microservice communication by generating short-lived access tokens based on defined scopes.
• Token Validation Services - Exposes JSON Web Key Set endpoints to allow external services to verify access tokens independently.
• Recipe-Based Modular Systems - Utilizes a recipe-based modular architecture to enable specific security features without modifying the core codebase.
• API Throttling - Limits incoming API requests per application and IP address to prevent service abuse and ensure stability.
• Horizontal Scaling - Distributes authentication traffic across multiple stateless service instances to handle high request volumes.
• Cross-Domain Authentication - Configures authentication cookies for cross-subdomain access to enable seamless session sharing.
• CSRF Protections - Restricts cookie transmission to same-site contexts to prevent cross-site request forgery attacks.
• New Device Alerts - Identifies and alerts on authentication attempts from previously unseen devices to prevent unauthorized access.
• Cross-Tenant User Associations - Connects existing user accounts to multiple tenants to grant access while maintaining unique identity records.
• Recovery Credentials - The authentication service allows users to regain access to their accounts using secondary verification methods when primary WebAuthn credentials are unavailable.
• Passkey Configurations - Customizes relying party identity and origin binding to integrate passkeys into application login flows.
• Route Protection - Restricts access to specific application views by verifying user session status and redirecting unauthenticated users.
• Step-up Authentication - The authentication service requires users to complete additional authentication challenges before accessing specific pages or performing sensitive actions to ensure ongoing security.
• Geographic Anomaly Detection - Detects fraudulent activity by identifying geographically impossible login patterns within short timeframes.
• Account Duplication Prevention - The authentication service intercepts authentication requests to verify if a user already exists and blocks registration if the provided credentials conflict with an existing account.
• Authentication SDK Bridges - Simplifies frontend integration by abstracting complex authentication flows into configurable client-side hooks.
• Authentication SMS Gateways - The authentication service integrates third-party messaging providers or custom logic to send authentication codes and magic links to users via text message.
• SMTP Integrations - The authentication service connects to external SMTP servers to send authentication-related emails using a custom domain and override default email templates or logic.
• GraphQL Authorizers - Authenticates GraphQL requests by validating user identity through an API gateway authorizer.
• Automatic Request Token Injection - Ensures secure communication with protected services by automatically injecting authentication tokens into outgoing network requests.
• Captcha Services - Embeds automated bot detection into authentication flows by supporting multiple third-party captcha providers.
• Device Fingerprinting - Maintains persistent device identifiers across sessions to recognize and track requesters.
• Embedded Session Authentication - Supports authentication within cross-origin iframes using header-based token transmission.
• Environment Configuration - Defines application metadata and network routing paths during initialization to ensure correct request mapping.
• Authenticator Security Validation - The authentication service inspects device metadata during registration to confirm the authenticity and security capabilities of the hardware being used.
• Username Authentication Configurations - Supports flexible user identification by allowing sign-in and registration via custom usernames.
• Registration Allow-Lists - The authentication service validates user contact information against a predefined list of authorized emails or phone numbers during the registration process to prevent unauthorized account creation.
• Account Linking - Connects secondary authentication accounts with primary user profiles to maintain consistent identity data.
• User Profile Management - Supports progressive profile collection to minimize onboarding friction while building complete user profiles over time.
• Session Claims - Extends session data models by embedding custom attributes directly into access tokens for stateless authorization.
• External Provider Redirections - Handles the redirection logic required to perform social logins via external identity providers.
• Event-Driven Hook Systems - Provides an event-driven hook system to trigger custom business logic during authentication lifecycle events.
• Custom Authentication Interfaces - Enables developers to implement custom frontend routes by disabling pre-built authentication components.
• Custom Metadata Storage - Allows storing arbitrary key-value data associated with user accounts for application-specific state.

Star history