$HEADLESS SYSTEMS
03 / Scorecard / Auth & Identity

SuperTokens

C
Headless Index
54/100
JAIRF
N/A
Verified
MAY 21, 2026
Methodology v1 · JAIRF v1.0.0

Powered by JAIRF v1.0.0 by Jentic · open methodology at /the-headless-index/methodology

Editorial verdict
SuperTokens is partially headless and partly UI-led. The Headless Index thesis-fit score of 54/100 puts it mid-table on the index, and JAIRF is recorded as N/A for this vendor because no public OpenAPI specification was reachable for the open-source scorer. In practice, vendors at this tier are partly machine-consumable: the core flows are reachable through code but several adjacent surfaces still expect a human at a dashboard, and the rest of this verdict explains where SuperTokens lands inside that pattern. On the API surface, the question is whether the API is the product or a layer beneath the dashboard. SuperTokens is open-source auth with a Core service exposing a REST API plus backend SDKs in Node, Python, Go, and Java. The architecture splits between the Core service and the framework drivers, which keeps the protocol layer self-host friendly. Strong developer mindshare on Hacker News and YC alumni groups.[1] Schema observability is the related test: can an agent introspect the contract from cold, or does it have to read prose documentation to do so? Core REST API is documented in detail; the open-source codebase in supertokens/supertokens-core is the implicit schema reference. No canonical OpenAPI URL is prominently exposed.[2] An agent can drive parts of this product, but not all of it: integrators should plan for human-in-the-loop checkpoints where the headless surface stops short. On headless operability: User flows, sessions, MFA, social login, passwordless, and roles are all programmable via the Core API. Self-hosted deployments expose the same surface as the managed Cloud. CLI tooling is limited but the SDK-first model is consistent across languages.[3] On the MCP and agent-integration axis, which is the fastest-moving criterion in the index: No first-party SuperTokens MCP server has been published. Community wrappers exist for agentic flows; the official posture remains focused on the identity-as-code use case.[4] Event posture closes the loop: an agent that cannot react to state changes is reduced to polling. Override functions in the SDK serve as webhook-ish hooks for identity events. A dedicated webhook delivery product is less central than the SDK override pattern. The eventing story is more code-driven than configuration-driven. Net assessment: integrators can build agent flows against SuperTokens, but the rough edge to plan around is MCP posture[5]. Expect to wrap missing pieces in bespoke glue or accept human-in-the-loop checkpoints. Workable but requires scaffolding.
Verdict by Headless Index pipeline (auto)
// AI-drafted from the evidence layer. Editorial review pending.
Scores

Scorecard detail

Headless Index · 5 sub-criteria
API-first design intent14/20
scored

SuperTokens is open-source auth with a Core service exposing a REST API plus backend SDKs in Node, Python, Go, and Java. The architecture splits between the Core service and the framework drivers, which keeps the protocol layer self-host friendly. Strong developer mindshare on Hacker News and YC alumni groups.

signals (6)
  • +AI review appliedReviewer: Editorial review on 2026-05-20
  • −OpenAPI specNot found across 17 probe paths
  • −GraphQL endpointNot discovered (5 probes; project-scoped endpoints require a real project ID)
  • +SDKs maintained12 (dotnet, go, java, javascript, python, swift, typescript); top by stars: supertokens/supertokens-node (329 stars)
  • +SDK recency2 of 12 SDK repos pushed within 30 days (most recent SDK commit: 2026-05-06)
  • +npm weekly downloads130.9k across published packages; top: supertokens-node @ 64.4k/week
cite (2)
  • github.sdks@2026-05-20
  • ai_review_browser.sdks@2026-05-20
Headless operation14/20
scored

User flows, sessions, MFA, social login, passwordless, and roles are all programmable via the Core API. Self-hosted deployments expose the same surface as the managed Cloud. CLI tooling is limited but the SDK-first model is consistent across languages.

signals (9)
  • +AI review appliedReviewer: Editorial review on 2026-05-20
  • −API operations exposedNo OpenAPI spec; operations count unknown
  • ·Docs pages crawled0 pages (crawler: none)
  • ·Auth schemes documentedAuth documentation page not reached by crawler
  • ·Setup / quickstart docsNot reached by crawler
  • ·Billing docsNot reached by crawler
  • ·Teams / org docsNot reached by crawler
  • ·CLI docsNot reached by crawler
  • ·Schema / data model docsNot reached by crawler
cite (1)
  • github.sdks@2026-05-20
MCP & agent posture6/20
scored

No first-party SuperTokens MCP server has been published. Community wrappers exist for agentic flows; the official posture remains focused on the identity-as-code use case.

signals (4)
  • +AI review appliedReviewer: Editorial review on 2026-05-20
  • +Official MCP serverhttps://github.com/supertokens/mcp-plugin (0 stars, last commit 285 days ago)
  • −Community MCP serversNone found
  • +Agent-friendly SDKs6 TS/JS SDKs available; top: supertokens-node (64.4k/week downloads)
cite (1)
  • mcp.found@2026-05-20
Schema observability12/20
scored

Core REST API is documented in detail; the open-source codebase in supertokens/supertokens-core is the implicit schema reference. No canonical OpenAPI URL is prominently exposed.

signals (3)
  • +AI review appliedReviewer: Editorial review on 2026-05-20
  • −OpenAPINot discovered across 17 standard probe paths
  • −GraphQL introspectionNo GraphQL endpoint discovered (5 probes; some vendors use project-scoped endpoints that require a real project handle)
cite (1)
  • openapi.discovered@2026-05-20
Webhooks & events8/20
scored

Override functions in the SDK serve as webhook-ish hooks for identity events. A dedicated webhook delivery product is less central than the SDK override pattern. The eventing story is more code-driven than configuration-driven.

signals (2)
  • +AI review appliedReviewer: Editorial review on 2026-05-20
  • ·Webhook docs pageNot reached by crawler within budget (0 pages crawled). Cannot confirm whether vendor offers webhooks.
cite (1)
  • ai_review_browser.webhooks@2026-05-20
JAIRF · 6 dimensions
JAIRF · N/A

This vendor does not publish a public OpenAPI specification. JAIRF cannot be computed. The Headless Index score and editorial verdict carry the readiness assessment.

No public OpenAPI specification discovered during collection

Powered by JAIRF v1.0.0 by Jentic

Band rationale:C band: scores 40-75 range

04 / Embed

Show SuperTokens's score on your site.

Drop a live badge into your README, footer, or marketing page. It updates automatically when we re-score, and every embed is a dofollow link back here.

SuperTokens mini badge preview
Get embed code
Peers in Auth & Identity
ClerkC
Headless Index 54/100
AuthsignalC
Headless Index 54/100
StytchC
Headless Index 52/100
See full Auth & Identity ranking →