Resend
Resend is wiring itself into every agent runtime it can reach, and now adding the controls to stop a send.
Comparison · Infra & APIs
SuperTokens vs WorkOS
A side-by-side editorial comparison of SuperTokens and WorkOS — release velocity, themes, recent moves, and the top alternatives to consider.
Shared themes:authentication
SuperTokens vs WorkOS: at a glance
| Feature | SuperTokens | WorkOS |
|---|---|---|
| Sector | Infra & APIs | Infra & APIs |
| Velocity score | 2.5 | 8.8 |
| Sparks · 30d | 0 | 2 |
| Top themes | authentication, saml, user-migration, account-linking | identity, authentication, ai-agents, scim |
| Last editorial update | 12d ago | 15h ago |
| Website | Visit → | — |
What is SuperTokens?
SuperTokens is hardening SAML and building a migration path off other auth providers.
SuperTokens is an open-source authentication service, and its core repo is running a 12.0 canary line alongside stable patches. The work in this window falls into two piles: SAML security — XML signature wrapping protection in 12.0.2-canary, further hardening in the 12.0.10 release — and migration mode, where new core-user-data records can be created as MIGRATED and the transition is now blocked while inconsistent users exist. Release notes are thin, usually a PR title or two per tag.
What is WorkOS?
WorkOS is building identity for agents while quietly fixing the sign-up funnel.
WorkOS ships several small entries a week, and August splits cleanly in two. One half is authentication housekeeping for human users: an Android SDK, deliverability checks that reject undeliverable addresses at sign-up, invitation acceptance counting as email verification, and a reversible SCIM proxy for migrating directory connections without downtime. The other half is agent infrastructure — Agent Registration via the auth.md protocol, and the Pipes Token Proxy that calls third-party APIs on a user's behalf without the application ever touching their token.
SuperTokens vs WorkOS: editorial side-by-side
SuperTokens
2.5INFRA · APIS
SuperTokens is hardening SAML and building a migration path off other auth providers.
◆ Current state
SuperTokens is an open-source authentication service, and its core repo is running a 12.0 canary line alongside stable patches. The work in this window falls into two piles: SAML security — XML signature wrapping protection in 12.0.2-canary, further hardening in the 12.0.10 release — and migration mode, where new core-user-data records can be created as MIGRATED and the transition is now blocked while inconsistent users exist. Release notes are thin, usually a PR title or two per tag.
◆ Where it's heading
Migration mode plus account-linking exploration is the tell: this is infrastructure for importing an existing user base from another provider without breaking identity linkage mid-flight, and the guard added in 12.0.5-canary shows they hit the inconsistent-state case in practice. The SAML work runs in parallel because enterprise SAML is what a team is usually migrating toward. Also worth noting: an automated contributor, supertokens-agent-runner, opened its first PRs in this window, so part of the fix and test volume is now agent-authored.
◆ Prediction
A stable 12.x release consolidating the canary migration-mode work is the readable next step, likely once the MIGRATED transition guards have run without incident. More SAML hardening should be expected given two separate fixes landed in this window alone.
WorkOS
8.8INFRA · APIS
WorkOS is building identity for agents while quietly fixing the sign-up funnel.
◆ Current state
WorkOS ships several small entries a week, and August splits cleanly in two. One half is authentication housekeeping for human users: an Android SDK, deliverability checks that reject undeliverable addresses at sign-up, invitation acceptance counting as email verification, and a reversible SCIM proxy for migrating directory connections without downtime. The other half is agent infrastructure — Agent Registration via the auth.md protocol, and the Pipes Token Proxy that calls third-party APIs on a user's behalf without the application ever touching their token.
◆ Where it's heading
The agent work is the strategic line. Registration gives an agent an identity of its own instead of a borrowed human session; the token proxy means an application acting for a user never holds the credential. Together they describe a stack where an agent can be authorized, audited and revoked as a first-class principal. The human-auth releases are conversion and migration work — the deliverability check and SCIM Bridge both remove reasons a customer stalls — which is what a developer-infrastructure company does while its next category is still forming.
◆ Prediction
Registration and the token proxy leave scoping and revocation as the visible gaps, so expect per-agent permissions or consent surfaces next. Whether auth.md gains adoption beyond WorkOS is not something these entries can answer.
Alternatives to SuperTokens and WorkOS
Other Infra & APIs products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either SuperTokens or WorkOS.
DNSControl
DNSControl v5 is feature-frozen with a ship date, and rc9 is pure provider cleanup
Casdoor
Casdoor is spending its release cadence moving auth checks from the client to the server
ESPHome
ESPHome ships on a calendar, and the August beta train is now five builds deep
Strimzi
Strimzi's 1.2.0 candidate closes with a logging fix and nothing else
Prowler
Prowler's assistant decides what to do with findings; the patches keep the scanner honest
See all SuperTokens alternatives → · See all WorkOS alternatives →
Recent activity from SuperTokens and WorkOS
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
- 2d agoWorkOSAndroid SDK
- 2d agoWorkOSHigher quality sign-ups with email deliverability checks
- 5d agoWorkOSMigrate SCIM Connections with SCIM Bridge
- 6d agoWorkOSAccepted invitations count as email verification
- 13d agoSuperTokensSAML hardening lands on the stable 12.0 line
- 13d agoWorkOSPipes Token Proxy ⚡
- 15d agoWorkOSAgent Registration ⚡
- 1mo agoSuperTokensMigration mode blocks transition while inconsistent users exist
- 1mo agoSuperTokens12.0.4-canary ships with no described changes
- 1mo agoSuperTokensActivity log table put into use
- 2mo agoSuperTokensSAML gains XML signature wrapping protection
- 2mo agoSuperTokensNew core user data records can be created as MIGRATED
Frequently asked questions
What is the difference between SuperTokens and WorkOS?
Both compete on the same themes — authentication — within Infra & APIs. WorkOS is currently shipping more aggressively (velocity 8.8 vs 2.5), with 2 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Is SuperTokens better than WorkOS?
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. WorkOS is currently shipping more aggressively (velocity 8.8 vs 2.5), with 2 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other Infra & APIs products to evaluate alongside.
What are the best alternatives to SuperTokens?
Top SuperTokens alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "SuperTokens alternatives" section above for the current picks, or visit /alternatives/supertokens for the full list with editorial commentary on each.
What are the best alternatives to WorkOS?
Top WorkOS alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "WorkOS alternatives" section above for the current picks, or visit /alternatives/workos for the full list with editorial commentary on each.