stack VS SuperTokens Community

Hi HN! We're building Stack Auth (https://stack-auth.com/), an open-source managed authentication and authorization platform. Basically, we build your login and signup pages, and everything that comes with that.

You can find our customer pitch elsewhere, so instead I'll tell you more about us and the company. We are developers building for other developers, so you can think of everyone here as a devX engineer. We launched with a Show HN in April, and have been growing exponentially since.

Think of us as a fast-moving open-source infrastructure business. We spend a lot of time thinking about how we can maintain the agility of a startup while being as reliable as incumbents. Sometimes, this means new ideas; for example, we heavily rely on AI and snapshots for our E2E tests, and have API migration tooling that blows everyone else out of the water. If you have ideas like these, we want you.

We've sworn to keep a no-bullshit culture. We're all pulling on the same string; we don't keep secrets from each other and always assume good faith. We want to build the open-source cloud infrastructure of the future; we'd rather die trying than sell out for a quick buck.

We are (very) well-funded by investors such as YC, Paul Graham, Guillermo Rauch, Theo Browne, and Khosla Ventures. Our number one priority is to build an outstanding product that developers *really* love — everything else comes second.

For now, we are exclusively hiring onsite in San Francisco; sadly, we don't currently have any remote positions. Optionally, you can move with us into our hacker house (both temporarily or permanent), but you can live in your own home too.

If that sounds like a great fit, email me mentioning that you're from HN and tell me why we caught your eye: konsti (at) stack-auth.com

Thanks all!

I'm biased but Stack Auth [0] is fully open-source, self-hostable, and we offer reasonably priced managed hosting, if that floats your boat.

[0] https://github.com/stack-auth/stack

Stack Auth maintainer here. Kinda disappointed by the lack of open-source solutions in this thread — if anyone's looking for managed auth like WorkOS/Clerk/Auth0, but wants it to be 100% open-source, you should give us a go. https://github.com/stack-auth/stack

Before we dive in, I want to quickly introduce Stack Auth, the open-source authentication library we’re building. It’s designed to be super easy to set up and offers a beautiful set of UI components right out of the box! Whether you’re building a SaaS product or your next side project, Stack Auth simplifies authentication without compromising on flexibility.

Not sure about Azure ecosystem but huge fan of https://clerk.com/.

Trying out https://stack-auth.com/ which just launched on HN, mostly out of OSS solidarity

We created a SECURITY.md file on our repo, it's in the .github folder: https://github.com/stack-auth/stack/blob/dev/.github/SECURIT...

If it helps you, we delegate the most vulnerable parts of the application, such as OAuth, to lower-level frameworks — similar to the unmanaged auth libraries people use today. We are essentially a thick wrapper around those, to create a full-stack platform from primitives.

The point I disagree with is that building it yourself is better than delegating it to a third-party — at best, you can secure your auth against vulnerabilities you're aware of. Unfortunately, this fallacy keeps coming up, but generally it's the case that homebrew auth is not more secure than open-source libraries, nor is proprietary code.

If you choose the latter, there's absolutely no reliance on us; if you think we're doing a bad job at any point in time, you can export all your data and start self-hosting instead.

Also, we're more than just authentication — we have authorization built-in (permissions, teams, ...), and a frontend to manage your users (with impersonation, filtering, ...). You can use any language to access these features through our REST API [1].

We also have a bunch of components for sign in, password reset, organizations. For now, we only support Next.js frontends and backends in any language with our REST API [1], though our docs also list the client endpoints, and some people have been building frontends for other languages.

For more info, check out our GitHub repo. We're really early, but have a handful of production users already. Any feedback is highly appreciated!

Thanks all!

[0] https://stack-auth.com

[1] https://docs.stack-auth.com/rest-api/auth

[2] https://github.com/stack-auth/stack

For B2C, Supabase will get you most of the way for small to medium MAU applications. You might need additional services for analytics and monitoring. If you are building a boom-or-bust B2C company (ex. social media platform, video game, media publication) you should consider using an open-source self-hosted solution like SuperTokens.

How does this compare to supertokens https://supertokens.com/ that supports fastify express, hono, bun, koa, nuxt, react, vue, angular with email password + social login + OTP based login + single sign on all wrapped in a self hostable nice package?

My love for Astro and the web platform is well documented. I've contributed to the docs, I've built some integrations and themes. I recently rediscovered the joy of building with Astro when I made a demo integration with SuperTokens. The ultimate goal for it was to become a part of the create-supertokens-app CLI (published here).

SuperTokens Core Service: This HTTP service talks to your database. It also contains the core logic for authentication. You can self-host with your database (with docker or without Docker or host it with a SuperTokens-managed service.

It all changed when I decided to sit in on an engineering weekly we had at SuperTokens one day. I'm not a part of the team, but I have to be up to date with what they do, so I listen in on their weeklies when I can. The exciting thing discussed there was https://cursor.sh. Rishabh, our CTO, was going on about how good it was making things more productive, so I thought, fine, I'll bite. It wasn't the first time I was told Cursor was really good. I have a friend who's been going on about Cursor for months (hi Vlad), and I was kinda skeptical. So, Vlad, you were right. Cursor is… well, pretty impressive.

How would you compare yourselves to SuperTokens (https://supertokens.com/)? I ask because they’re another open source, YC backed auth system, and one that I’ve quite enjoyed using on a side project.

2. SuperToken - Open Source User Auth

Your project will need to be using Supertokens as the method of authentication.