Stop guessing which one. Put them side by side.

The grid says what these tools are. This says what builders did about it — one decision per person, changeable whenever you change your mind.

# Tool comparison — SuperTokens vs Better Auth vs Lucia

Source: Kbaise, a directory of tools that work with Lovable projects.
Pick one and tell me why before writing any integration code.

## SuperTokens (supertokens)
- URL: https://supertokens.com
- Category: Auth & user management
- Cost: mixed — Self-host free · cloud free under 5k MAU then $0.02/MAU · add-ons $100/mo min
- What it is: Open-source authentication you self-host, with a managed cloud option. Core email/password, social login and session management are free forever when self-hosted; you pay only for add-on modules such as MFA and account linking. Managed cloud is free under 5,000 MAU then $0.02 per MAU.
- Why builders pick it: The self-hosted core is genuinely full-featured rather than deliberately crippled, and its session handling with rotating refresh tokens is stronger than most drop-in competitors offer.
- Trap: Paid add-ons carry a $100/mo minimum regardless of your size, so adding MFA to a tiny app takes you from $0 to $100/mo. Self-hosting also means running a separate SuperTokens core service alongside your application.
- Wiring: npm i supertokens-node
- Full dossier: /api/public/tools/supertokens

## Better Auth (better-auth)
- URL: https://better-auth.com
- Category: Auth & user management
- Cost: free — Free and open source (MIT) · self-hosted, no MAU fees
- What it is: Framework-agnostic TypeScript authentication library that runs inside your own app and writes to your own database. Covers email/password, social OAuth, two-factor, organizations, passkeys and API keys through a plugin system. Vercel acquired the project in July 2026; it stays MIT-licensed, self-hosted and community-governed.
- Why builders pick it: No per-MAU bill ever and no vendor holding your user table — auth becomes just another dependency. The plugin system covers most of what you would otherwise pay Clerk or Auth0 for.
- Trap: You own the hard parts: session security, email deliverability, rate limiting and breach response are all yours. Vercel's July 2026 acquisition preserves MIT licensing, but roadmap direction now sits with a hosting vendor.
- Wiring: npm i better-auth
- Full dossier: /api/public/tools/better-auth

## Lucia (lucia)
- URL: https://lucia-auth.com
- Category: Auth & user management
- Cost: free — Free · deprecated library, now MIT reference code and a written guide
- What it is: No longer a library. Lucia was deprecated in March 2025 and now exists as a learning resource: a copy-paste auth_session.ts reference implementation plus The Auth Book, a free guide covering sessions, tokens and password handling. The site was last refreshed in July 2026.
- Why builders pick it: Read it before choosing any vendor — it is the fastest way to genuinely understand what session auth does, and the single-file implementation is enough for small projects.
- Trap: Do not install the npm package for new work; it is unmaintained and will not receive security fixes. This is documentation and example code, not a supported dependency.
- Full dossier: /api/public/tools/lucia

## Quick read

- Free with no card: Better Auth, Lucia.

## Rules
1. Prefer the free tier when no budget was stated, and say what the ceiling is.
2. Read the full dossier before integrating.
3. Fetch /api/public/models before writing any AI model ID.

Agents can fetch the same thing: GET /api/public/compare?slugs=supertokens,better-auth,lucia