advaitruia

What do you think about Supertokens.io?

Granted its not as mature but its open source, easy to implement (decouples features based on your use case), really customizable frontend UI and great support (ping me anytime!)

Author of the article here. Feel free to AMA about the acquisition (or about SuperTokens)

Depending on what set of features you need, it may make sense to also have a look at SuperTokens.io. Probably not as mature but we're open source and stronger with customization of the end user experience (frontend stuff), support and ease of implemenetation.

Have you seen SuperTokens.io? Its open source authentication. Maybe not as mature as Amazon, Google and Okta but we'll get there!

Cheald, SuperTokens isnt as mature as Keycloak but we make up for it in other ways (ease of implementation, frontend UI, hosted offering, docs and support). Would appreciate your consideration!

Thanks for the Shoutout!

We're working on it! Passwordless will be our next release in a few weeks and then 2FA comes next

Thanks! Cofounder of SuperTokens here - please let us know if you have any feedback or questions. I can be reached at advait @ supertokens.io

I am the cofounder of SuperTokens. Thank you for the shoutout.

Yes, in terms of features, we're working quickly to add functionality while being cognizant of maintaining simplicity. If you have any questions or feedback, please reach out (advait at supertokens dot io)

1. Neither of these are open source. Also, the only option that can be run on premise

2. We take a modular approach to our architecture. This enables developers to choose only the features SuperTokens they need for their use case. They need not worry about complications associated with other features (eg: SSO and OAuth if you don’t need it) and this in turn makes it easier to implement and manage SuperTokens. This is not true for the others. Regardless of your use case, you likely have to worry about Oauth flows and integrating with a '3rd party' app.

3. Heavy focus on keeping documentation simple and easy to understand. We want to 'just work' for you. We spend a significant amount of our effort on simplifying every step of implementation (this is ongoing and iterative). we've often had complaints from auth0 and cognito users for this.

4. Pricing (compared to Auth0 atleast)

We plan on adding Django support asap. If you could share your email ID or drop me an email at advait at supertokens.io - I will update you as soon as we have the Django SDK ready

You wouldnt need to install your own JDK. We package it all nicely in a docker container so you do not have to worry about it. This makes running SuperTokens just like running any other http microservice.

But yes, your point is valid. If you'd like to be able to know the intimate details and make modifications (that we dont offer), then this would hold true. But all in all, the reasons we picked java were:

Java has a very mature ecosystem. This implies that third party libraries have been battled tested. It's strong type system ensures fewer bugs and easier maintainability. This is especially important when many people are expected to work on the same project (for open source).

Thats awesome! Thank you

We expect to have Flask login ready sometime early next year. If you could drop me an email on advait at supertokens.io - I'll let you know when its released!

Yes, SuperTokens comes with pre made UI. You can choose from one of the three themes we have available and can easily customize the colours / CSS for either of those themes. We also make it possible to easily add your own theme if you like.

The docs are here: https://supertokens.io/docs/emailpassword/common-customizati...

Thank you! Let me if you need any help setting up SuperTokens

Thank you Ashwin! Yes, that is the plan. WOuld love to hear your experiences using Cognito!

Do you mind sharing your email ID or dropping me an email at advait at supertokens.io? We should have it ready by Jan (and hopefully in time for you)

We do have a frontend component as well as instructions for implementing the backend. Currently we support login for nodejs and session management is supported for several frameworks. We will be adding login support in the near future

Actually we offer the most secure way of managing session tokens. We were the first provider to implement token theft detection using rotating refresh tokens (and most still dont). Auth0 even uses one of our libraries for solving for edge cases. I dont think that good security = complex documentation. Its about the way you abstract away the complexity.

Will factor your feedback when we design the website and think about communication.

Please do let me know when you've had a chance to check it out. Would be happy to hear your feedback

Yes, that sounds pretty strange - thank you for sharing. Haha yes, it is surprising on the face of it. But when you think about it, its not trivial to make that everything is seamless for all use cases. It requires a lot of time and constant iteration and feedback. Being a maintainer is anyway not easy and when you have the entire framework to maintain, these things happen more often than not.

On the frontend side, we have two libraries - supertokens-auth-react and supertokens-website. The supertokens-website repo deals with sessions (interceptors to axios for refresh + race condition synchronisation). On the other hand, supertokens-auth-react provides login / sign up UI + session management (it uses supertokens-website).

Thank you for the commendation! Would love to hear your feedback. Please do drop me an email on: advait at supertokens.io

Cuídate! (love Spain, have several friends and have visited barcelona, majorca, Sevilla and more)

Thank you!

We do keep track of all feedback and requests on a private Github repo and use that to prioritize. However, I agree - maybe we can have a public page where users can submit and vote for their preferences.

We're excited about user management too! We already have custom fields that you can add to the SuperTokens sign up / sign in form. We'll add passwordless soon after social login / email verification

From our conversations with developers, a surprisingly large number of their users use social login - even when the site provides alternatives. Many have categorically said that they cant use any solution without social login. And we've seen this generally be true across many use cases

To an extent, yes: https://supertokens.io/docs/emailpassword/common-customizati...

Typical multi tenancy implies that the auth experience and data is isolated per tenant. However, often b2b companies simply want to provide an auth experience to their client within a specific subdomain. They do not mind the auth data be stored in the same db tables as other clients. If this is the use case, then we do support it. If you want strict isolation of auth per tenant, then you will have to deploy multiple instances of the SuperTokens core (as of today).

Sorry, I am not sure I completely understand. When you say that we may not be able to provide because it would be expensive - do you mean it would be expensive for us to build or for startups to buy? What exactly would the catch 22 situation be?

Thank you for the encouragement, we appreciate it!

We are happy with developers and early stage startups using SuperTokens for free. Our plan is to monetize feature that are required by enterprises. We have a philosophy section in the pricing page that explains this is more details

Thank you! Best of luck :)

Thank you for your candid feedback. Those reasons were also echoed in our user research as we were dedicating ourselves to the project.

Could you please share why you think those arent good enough reasons? Ofcourse, social proof is important regardless. SuperTokens is being used in the real world, in production. Would you like to see more people using it or some recognizable entreprise brand names?

Thank you! We appreciate it and hope to make that wait as short as possible

Email verification and social login is what we are currently working on. But C# isnt a common request at the moment. We'll definitely try to get to it asap. If you are interested, you could contribute the C# SDK together with us.

We do not currently have a bug bounty program.

You can use functions exposed via our SDK to verify & refresh a session yourself in your APIs - if that is what you were asking? Apologies if I misunderstood.