SuperTokens vs BuildBase: where free self-hosting stops being free

SuperTokens costs nothing to run. That is not a marketing line, it is the licence: the core is Apache 2.0, you host it next to your app, and there is no cap on how many people sign in. If that is the whole of your problem, go and install it.

The interesting part is what happens after that.

The one-paragraph answer

Pick SuperTokens if you want to own the deployment, your team is happy running a service and its database, and your requirements stop at the sign-in box. Pick BuildBase if sign-in is the small half of the problem and the real work is workspaces, subscriptions, quotas and the mail that goes with them. The money question is not free against $19, though, because SuperTokens charges for multi-factor sign-in, account linking and multi-tenancy on self-hosted installs too, and the first two carry a $100 a month minimum whatever your user count.

Where each fits

SuperTokens is built out of recipes you compose: email and password, passwordless by one-time code or magic link, social login, passkeys, unified login through an OAuth2 provider, machine-to-machine tokens, multi-factor authentication with step-up, and enterprise login with multi-tenancy. You run the core yourself or let them run it. The backend SDKs are Node.js, Python and Go, and the front end is React or the framework-agnostic web-js package. That Python and Go support matters more than it sounds: it is the reason SuperTokens turns up in stacks where the API is not JavaScript at all.

BuildBase starts somewhere else. The centre is the workspace, not the session. A person signs in, belongs to workspaces with roles, and each workspace carries a plan, quotas, credits and invoices. Authentication is the front door to that and one of 20 modules in a single instance, rendered on a hosted sign-in page. You do not assemble recipes; you tick the methods an app offers and the page draws them.

So the two products answer different questions. SuperTokens asks how sign-in should work and gives you a lot of rope. BuildBase assumes sign-in is solved and asks what the account does once it exists.

Sign-in methods

BuildBase ships email and password, magic links, email codes, phone codes, passkeys, Google, LinkedIn, GitHub, Microsoft, Apple, one OpenID Connect or OAuth 2.0 provider of your own, and Ethereum and Solana wallets. Phone sign-in uses text-message codes through your own Twilio account or a signed webhook. Around those sit Google One Tap, usernames, guest users and device code sign-in for CLIs and televisions. Two-step sign-in is an authenticator app with single-use backup codes, or text-message codes through that same provider, under one policy for the organization that is off, optional or required, and an authenticator app or a passkey is the stronger choice. Separately, every app is an OAuth 2.0 authorization server, which is how agents and third-party apps get access.

SuperTokens covers the same ground at the sign-in box and goes further past it, with step-up authentication and an attack protection suite. The difference is not the list. It is that multi-factor sits behind a paid add-on there and inside the plan here.

Pricing, verified 30 October 2026

SuperTokens publishes two ways to run it. Self-hosted is free and open source with no limit on monthly active users. SuperTokens Cloud is $0.02 per monthly active user, free under 5,000 MAU, and past that threshold the rate applies to every active user rather than only the ones above the line, which their own worked example confirms.

Then the add-ons, which apply to both:

• Multi-factor authentication, $0.01 per MAU, minimum billing $100 a month
• Account linking, $0.005 per MAU, minimum billing $100 a month
• Dashboard users, 3 free, then $20 per user per month
• Multi-tenancy and organisation support, priced on request

Unified login across domains, machine-to-machine auth, multi-availability-zone infrastructure with uptime SLAs, the attack protection suite and implementation help are all contact-only.

Read that $100 as a floor under the bill rather than a charge per add-on. The worked example on their pricing page puts 5,000 MAU with account linking at $125 a month, which is the per-user rates added together and compared against the floor, not stacked on top of it. Below 5,000 users the same example lands on a flat $100.

BuildBase publishes four plans: Free at $0 with 10,000 monthly active users, Launch at $19 a month with 25,000, Grow at $49 with 100,000, and Scale at $99 with 500,000. Free stops at its allowance rather than billing. The paid plans start with a 7-day trial that does not ask for a card, and yearly billing is ten months for twelve.

At list price, with multi-factor sign-in switched on in both:

Three things keep that table honest. The MFA column is only the right column if you actually need a second factor, and plenty of products do not. The rows above 10,000 MAU are list price before any discount, and SuperTokens openly invites a conversation there, so treat $2,000 as an opening number rather than a bill. And self-hosting moves the core to $0 at every row, at the cost of running it, though the add-on rows do not move at all.

That last point is the one worth sitting with. Self-hosting is free; the features a B2B product reaches for are not. A team on a self-hosted install with 800 users and a second factor is paying the $100 minimum for MFA on top of infrastructure they maintain themselves.

How to decide

Ask what you are optimising for, because the two answers barely overlap.

If it is control, cost at scale, or a server language that is not JavaScript, SuperTokens is the better instrument, and the self-hosted tier is as free as it claims to be. Budget for the add-ons you will actually switch on, since that is where the published price and the real one diverge. The same reasoning applies to any vendor in this shape, which is what self-hosted vs open source and the real cost of self-hosting against a managed service both work through in more detail.

If what you are really buying is the account system behind the login - teams that invite colleagues, plans that run out, invoices that have to agree with entitlements - then the auth decision is the small half, and a free auth server does not help with the big half. That is the case BuildBase is built for. Best auth for B2B SaaS sorts the field by whether you need SSO yet, and the Clerk and WorkOS comparisons make the same trade from the managed side.

And if you are weighing either against writing it yourself, the cost of building auth yourself has that arithmetic.

Sources

SuperTokens figures verified 30 October 2026 on SuperTokens' own pages: supertokens.com/pricing (the self-hosted and cloud tiers, the $0.02 per MAU rate, the free allowance under 5,000 MAU, the MFA and account linking add-ons with their $100 minimums, dashboard users at $20, and the volume-discount invitation above 10,000 MAU), the enterprise login overview (SAML and OIDC, tenant creation from your backend, isolated user pools and the built-in providers), the backend SDK reference (Node.js, Python and Go) and supertokens-core on GitHub (Apache 2.0, with the ee/ directory under a separate licence). BuildBase plans are our published pricing, last checked against the pricing page on 31 October 2026 (PLAN_FACTS).