Repo brief: supertokens/supertokens-core

Generated by RepoPilot · document generated 2026-09-16 · concise human review Evidence snapshot · analyzed 2026-09-16T05:09:35.992Z · commit d20a0efcc390

Verdict

Healthy — Healthy across all four use cases

• Last commit today
• 6 active contributors
• Apache-2.0 licensed
• CI configured
• 1 more receipt on the live page

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against dependency CVEs from deps.dev and OpenSSF Scorecard

What it is

SuperTokens Core is a self-hosted authentication and session management HTTP service written in Java that replaces managed auth providers like Auth0 and Firebase. It provides passwordless login, social login, email/phone password auth, MFA, multi-tenancy, and role-based access control—deployed as a centralized microservice that backend SDKs communicate with to handle auth logic and database operations. Monolithic Java application structured by domain: src/main/java/io/supertokens/ contains core modules (authRecipe, bulkimport, cronjobs, config, auditlog) organized by feature. Entry point is Main.java; configuration managed via Config.java with annotation-driven YAML parsing; cronjobs…

Start here

Open these first:

• src/main/java/io/supertokens/Main.java — Application entry point and primary initialization logic for the SuperTokens core service.
• src/main/java/io/supertokens/config/CoreConfig.java — Central configuration schema definition that all deployment modes and environment variables flow through.
• src/main/java/io/supertokens/authRecipe/AuthRecipe.java — Core authentication recipe abstraction handling sign-up, sign-in, session management across all auth methods.
• src/main/java/io/supertokens/ResourceDistributor.java — Service locator and dependency injection mechanism managing storage backends, recipes, and cron jobs.
• src/main/java/io/supertokens/cronjobs/Cronjobs.java — Scheduler and coordinator for background tasks like token cleanup, bulk imports, and telemetry.

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

Repository appears to use Gradle (build.gradle present with plugins 'application' and 'java-library', AspectJ support). Inferred commands: git clone https://github.com/supertokens/supertokens-core.git, `cd supertokens…

Daily commands:

Not fully evident from snippet. Based on Gradle structure: ./gradlew run should start the application (application plugin configured). Core likely listens on HTTP for SDK requests. Requires database configuration (evi…

…shortened for this brief.

Key cautions & unknowns

• Concentrated ownership — top contributor handles 53% of recent commits
• 1. Java 21 requirement: Gradle toolchain configured for Java 21 (JavaLanguageVersion.of(21)); builds will fail on older JDK versions. 2. AspectJ weaving: Build depends on AspectJ plugin v8.13 (same as Gradle…
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests
• OpenSSF Scorecard
• License evidence

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.