LoginSign Up
← Back to all sparks
S

SuperTokens

INFRA · APIS
Velocity3.8

Open-source user authentication and session management for web and mobile.

supertokens.com ↗

SuperTokens ships an activity log — laying groundwork for enterprise audit trails and usage analytics.

authself-hostedactivity-logdevtoolsenterprise-authmulti-tenant
◆Current state
SuperTokens is a self-hostable auth backend that has spent the v12 cycle systematically hardening its security surface (SAML XSW protection, account linking integrity guards) and extending its multi-tenant infrastructure. The v12.3.0 canary drops a complete lifecycle event system: every user creation, deletion, tenant association, and account linking action now emits into an append-only activity log. User counts are derived from ledger folds rather than direct writes, replacing the old point-in-time approach with a rolling, auditable record.
◆Where it's heading
SuperTokens is moving from a stateless auth gateway toward a stateful user-activity platform. The activity log's anchor-plus-ledger pattern, per-domain retention controls, and shadow audit infrastructure signal intent to offer compliance-grade audit trails — not just auth tokens. The rollup cron and approximate-count serving suggest upcoming billing or analytics surfaces that will consume this event stream.
◆Prediction
The next move is exposing the activity log via API — either as a customer-facing audit export or as input to usage-based billing. The retention config and per-domain protection are already wired; a read API is the missing piece.

◆Recent moves

  1. 3d ago

    SuperTokens v12.3: Activity log and lifecycle event system

    ⚡ SPARK

    The v12.3.0 canary lands a complete lifecycle event system — user creation, deletion, tenant disassociation, and account linking all emit into an append-only activity log. User counts are now derived from ledger folds instead of direct writes, and a rollup cron keeps per-storage counts accurate for separate-database tenants. This is the largest architectural addition to SuperTokens core since multi-tenancy landed.

    View source ↗
  2. 1mo ago

    SuperTokens v12.0.10: SAML hardening

    A single SAML security patch with no other user-visible changes. Maintenance-tier fix in an otherwise active development period.

    View source ↗
  3. 2mo ago

    SuperTokens v12.0.5: Account linking fixes and migration guard

    Account linking bug fixes and a guard that prevents transitioning to MIGRATED migration mode while inconsistent users exist — closing a data integrity gap for teams running multi-tenant auth migrations. The supertokens-agent-runner bot making its first contribution signals automated tooling entering the core development loop.

    View source ↗
  4. 2mo ago

    v12.0.4-canary

    A canary cut with no documented changes — a version bump in the release chain with no visible user impact.

    View source ↗
  5. 2mo ago

    SuperTokens v12.0.3: Activity log table integration begins

    The first integration of the activity_log table into core, laying the storage foundation for the lifecycle event system that fully lands in v12.3.0. Visible in hindsight as the first public commit of a months-long architectural project.

    View source ↗
  6. 3mo ago

    SuperTokens v12.0.2: SAML XSW attack protection

    Adds protection against XML Signature Wrapping attacks on SAML flows — a real attack class that lets adversaries forge auth assertions. A meaningful security fix for any SAML-relying-party deployment on SuperTokens.

    View source ↗