LoginSign Up
← Back to all sparks
S

SuperTokens

INFRA · APIS
Velocity5.0

Open-source user authentication and session management for web and mobile.

supertokens.com ↗

SuperTokens tags 12.0.12 three weeks after its seven-advisory security release.

authself-hostedsamlsecuritymulti-tenant
◆Current state
SuperTokens is a self-hostable auth backend. v12.0.12 on Nov 5 ships with only a compare link and no notes. The previous release, 12.0.11, fixed seven advisories, added SAML replay protection and made IdP-initiated SAML login require an ACS URL allow-list. The v12.3.0 canary in September added an activity log of user lifecycle events.
◆Where it's heading
The stable 12.0 line is in patch mode, mostly security, while lifecycle events mature in the canary line. The gap between canary features and stable releases is still open.
◆Prediction
It is unclear from the feed when the activity log reaches stable; more 12.0.x patches are the likely near-term output.

◆Recent moves

  1. 8d ago

    SuperTokens 12.0.12 patch (no notes published)

    A patch on the stable 12.0 line with only a compare link. It follows the 12.0.11 security release; what changed is not stated.

    View source ↗
  2. 28d ago

    SuperTokens 12.0.11: SAML replay protection and seven security fixes

    A security release covering seven advisories, including SAML replay protection and a new ACS URL allow-list that existing IdP-initiated clients must set before logins resume. It continues the 12.0 hardening track, and SAML operators need to act on upgrade.

    View source ↗
  3. 2mo ago

    SuperTokens v12.3: Activity log and lifecycle event system

    ⚡ SPARK

    The v12.3.0 canary lands a complete lifecycle event system — user creation, deletion, tenant disassociation, and account linking all emit into an append-only activity log. User counts are now derived from ledger folds instead of direct writes, and a rollup cron keeps per-storage counts accurate for separate-database tenants. This is the largest architectural addition to SuperTokens core since multi-tenancy landed.

    View source ↗
  4. 3mo ago

    SuperTokens v12.0.10: SAML hardening

    A single SAML security patch with no other user-visible changes. Maintenance-tier fix in an otherwise active development period.

    View source ↗
  5. 4mo ago

    SuperTokens v12.0.5: Account linking fixes and migration guard

    Account linking bug fixes and a guard that prevents transitioning to MIGRATED migration mode while inconsistent users exist — closing a data integrity gap for teams running multi-tenant auth migrations. The supertokens-agent-runner bot making its first contribution signals automated tooling entering the core development loop.

    View source ↗
  6. 4mo ago

    v12.0.4-canary

    A canary cut with no documented changes — a version bump in the release chain with no visible user impact.

    View source ↗