# SuperTokens vs BuildBase: where free self-hosting stops being free > SuperTokens core is free to self-host at any scale. MFA, account linking and multi-tenancy are paid add-ons with a $100 a month floor. How that compares with BuildBase, free to 10,000 users. - Source: https://www.buildbase.app/compare/supertokens-vs-buildbase - Section: Comparisons - Author: Dharmendra Jagodana - Published: 2026-10-30 ## In short SuperTokens is open source and free to self-host at any user count; its managed cloud is $0.02 per monthly active user, free under 5,000. MFA, account linking and multi-tenancy are paid add-ons with a $100 a month floor, self-hosted too. BuildBase has a Free plan to 10,000 users, then Launch at $19 for 25,000. SuperTokens costs nothing to run. That is not a marketing line, it is the licence: the core is Apache 2.0, you host it next to your app, and there is no cap on how many people sign in. If that is the whole of your problem, go and install it. The interesting part is what happens after that. ## The one-paragraph answer Pick SuperTokens if you want to own the deployment, your team is happy running a service and its database, and your requirements stop at the sign-in box. Pick BuildBase if sign-in is the small half of the problem and the real work is workspaces, subscriptions, quotas and the mail that goes with them. The money question is not free against $19, though, because SuperTokens charges for multi-factor sign-in, account linking and multi-tenancy on self-hosted installs too, and the first two carry a $100 a month minimum whatever your user count. ## Where each fits SuperTokens is built out of recipes you compose: email and password, passwordless by one-time code or magic link, social login, passkeys, unified login through an OAuth2 provider, machine-to-machine tokens, multi-factor authentication with step-up, and enterprise login with multi-tenancy. You run the core yourself or let them run it. The backend SDKs are Node.js, Python and Go, and the front end is React or the framework-agnostic web-js package. That Python and Go support matters more than it sounds: it is the reason SuperTokens turns up in stacks where the API is not JavaScript at all. BuildBase starts somewhere else. The centre is the workspace, not the session. A person signs in, belongs to workspaces with roles, and each workspace carries a plan, quotas, credits and invoices. Authentication is the front door to that and one of 20 modules in a single instance, rendered on a hosted sign-in page. You do not assemble recipes; you tick the methods an app offers and the page draws them. So the two products answer different questions. SuperTokens asks how sign-in should work and gives you a lot of rope. BuildBase assumes sign-in is solved and asks what the account does once it exists. ## Sign-in methods BuildBase ships email and password, magic links, email codes, phone codes, passkeys, Google, LinkedIn, GitHub, Microsoft, Apple, one OpenID Connect or OAuth 2.0 provider of your own, and Ethereum and Solana wallets. Phone sign-in uses text-message codes through your own Twilio account or a signed webhook. Around those sit Google One Tap, usernames, guest users and device code sign-in for CLIs and televisions. Two-step sign-in is an authenticator app with single-use backup codes, or text-message codes through that same provider, under one policy for the organization that is off, optional or required, and an authenticator app or a passkey is the stronger choice. Separately, every app is an OAuth 2.0 authorization server, which is how agents and third-party apps get access. SuperTokens covers the same ground at the sign-in box and goes further past it, with step-up authentication and an attack protection suite. The difference is not the list. It is that multi-factor sits behind a paid add-on there and inside the plan here. ## Pricing, verified 30 October 2026 SuperTokens publishes two ways to run it. **Self-hosted** is free and open source with no limit on monthly active users. **SuperTokens Cloud** is $0.02 per monthly active user, free under 5,000 MAU, and past that threshold the rate applies to every active user rather than only the ones above the line, which their own worked example confirms. Then the add-ons, which apply to both: - Multi-factor authentication, $0.01 per MAU, minimum billing $100 a month - Account linking, $0.005 per MAU, minimum billing $100 a month - Dashboard users, 3 free, then $20 per user per month - Multi-tenancy and organisation support, priced on request Unified login across domains, machine-to-machine auth, multi-availability-zone infrastructure with uptime SLAs, the attack protection suite and implementation help are all contact-only. Read that $100 as a floor under the bill rather than a charge per add-on. The worked example on their pricing page puts 5,000 MAU with account linking at $125 a month, which is the per-user rates added together and compared against the floor, not stacked on top of it. Below 5,000 users the same example lands on a flat $100. BuildBase publishes four plans: **Free** at $0 with 10,000 monthly active users, **Launch** at $19 a month with 25,000, **Grow** at $49 with 100,000, and **Scale** at $99 with 500,000. Free stops at its allowance rather than billing. The paid plans start with a 7-day trial that does not ask for a card, and yearly billing is ten months for twelve. At list price, with multi-factor sign-in switched on in both: | Monthly active users | SuperTokens Cloud, core only | Cloud plus the MFA add-on | BuildBase | | -------------------- | ---------------------------- | ------------------------- | ------------ | | 2,500 | $0 | $100 (the floor) | $0 (Free) | | 5,000 | $100 | $150 | $0 (Free) | | 25,000 | $500 | $750 | $19 (Launch) | | 100,000 | $2,000 | $3,000 | $49 (Grow) | Three things keep that table honest. The MFA column is only the right column if you actually need a second factor, and plenty of products do not. The rows above 10,000 MAU are list price before any discount, and SuperTokens openly invites a conversation there, so treat $2,000 as an opening number rather than a bill. And self-hosting moves the core to $0 at every row, at the cost of running it, though the add-on rows do not move at all. That last point is the one worth sitting with. Self-hosting is free; the features a B2B product reaches for are not. A team on a self-hosted install with 800 users and a second factor is paying the $100 minimum for MFA on top of infrastructure they maintain themselves. | Feature | BuildBase | SuperTokens | | --- | --- | --- | | Free tier | Free plan to 10,000 MAU; 7-day trial on paid plans | Self-hosted core free at any scale; cloud free under 5,000 MAU | | At 25,000 MAU, core only | $19/mo (Launch) | $500/mo (cloud) or $0 self-hosted | | Second factor | Authenticator app, backup codes or text-message codes, in the plan | Add-on at $0.01/MAU, minimum $100/mo | | SAML and enterprise SSO | Not available | Via multi-tenancy, a paid add-on, price on request | | Where the data lives | Our instance, or a per-organization database | Your database if self-hosted, theirs if cloud | | Backend languages | JavaScript and TypeScript | Node.js, Python and Go | | Front-end coverage | Next.js, Vite, React Router / Remix, TanStack Start | React, plus a framework-agnostic web-js package | | Billing, workspaces, email, workflows | Included, 20 modules in one instance | Not part of the product | > **Where SuperTokens wins:** SuperTokens wins several of these outright, and if one of them is on your list > the comparison is already settled. > > **You can run it yourself, for nothing.** The core is Apache 2.0 and the > self-hosted tier has no user ceiling. No vendor can take that away from you, > and no pricing change next year can either. We have nothing equivalent to > offer, and for a team whose first requirement is owning the deployment, that is > the end of the conversation. > > **SAML and per-tenant user pools.** Enterprise login lives inside SuperTokens' > multi-tenancy feature: tenants created from your own backend with a few API > calls, isolated user pools, optional separate databases per tenant, and > providers including Okta, Active Directory, Google Workspaces, GitLab and > Bitbucket alongside a generic SAML option. We do not ship SAML. If a security > review asks for it, pick them. > > **Python and Go.** Their backend SDKs cover all three major server languages. > Ours is for JavaScript and TypeScript backends. A Django or Go API is a > straightforward SuperTokens install and not a BuildBase one. > > **Free at any scale, if you host it.** The self-hosted core costs nothing > however many people sign in. Our Free plan stops at 10,000 monthly active > users and 50 workspaces, and past that you pay for a plan. > > **Machine-to-machine tokens and unified login.** OAuth2 client credentials for > service-to-service calls, and one login shared across web, mobile and desktop > apps, are documented products there. ## How to decide Ask what you are optimising for, because the two answers barely overlap. If it is control, cost at scale, or a server language that is not JavaScript, SuperTokens is the better instrument, and the self-hosted tier is as free as it claims to be. Budget for the add-ons you will actually switch on, since that is where the published price and the real one diverge. The same reasoning applies to any vendor in this shape, which is what [self-hosted vs open source](/blog/self-hosted-vs-open-source) and [the real cost of self-hosting against a managed service](/blog/self-host-vs-managed-cost) both work through in more detail. If what you are really buying is the account system behind the login - teams that invite colleagues, plans that run out, invoices that have to agree with entitlements - then the auth decision is the small half, and a free auth server does not help with the big half. That is the case BuildBase is built for. [Best auth for B2B SaaS](/compare/best-auth-for-b2b-saas) sorts the field by whether you need SSO yet, and the [Clerk](/compare/clerk-vs-buildbase) and [WorkOS](/compare/workos-vs-buildbase) comparisons make the same trade from the managed side. And if you are weighing either against writing it yourself, [the cost of building auth yourself](/blog/cost-of-building-auth-yourself) has that arithmetic. ## Sources SuperTokens figures verified 30 October 2026 on SuperTokens' own pages: [supertokens.com/pricing](https://supertokens.com/pricing) (the self-hosted and cloud tiers, the $0.02 per MAU rate, the free allowance under 5,000 MAU, the MFA and account linking add-ons with their $100 minimums, dashboard users at $20, and the volume-discount invitation above 10,000 MAU), [the enterprise login overview](https://supertokens.com/docs/authentication/enterprise/overview) (SAML and OIDC, tenant creation from your backend, isolated user pools and the built-in providers), [the backend SDK reference](https://supertokens.com/docs/references/backend-sdks/reference) (Node.js, Python and Go) and [supertokens-core on GitHub](https://github.com/supertokens/supertokens-core) (Apache 2.0, with the `ee/` directory under a separate licence). BuildBase plans are our published pricing, last checked against the pricing page on 31 October 2026 (PLAN_FACTS).