SuperTokens

Java core service (SuperTokens Core) exposing an HTTP API, backed by Postgres or MySQL for session/user storage, with thin backend SDKs that embed session verification directly into the app server — sessions never trust the client.

The core service is stateless per request (all session state lives in the DB), so it scales horizontally behind a load balancer, and Postgres can be scaled with standard read replicas. This is a proper backend-managed auth model — no tokens or secrets are trusted client-side — which is the main reason its security score is high relative to peers.

Deploy the core as its own pod plus a postgres pod, with the app's backend SDK pod calling the core over supertokens-core.pod:3567. Mirror the official core image via mirror.gcr.io and set the connection URI and API keys as env vars rather than baking them into the image.