Goal

Demonstrate a proof-of-concept (POC) migration from SuperTokens to Frontegg for authentication/session management, as part of the broader provider switch initiative (Switch Authentication Provider: Research, Selection, and Migration).

Scope

• Integrate Frontegg's authentication & session management module into a branch
• Replicate core auth flows:
  • Sign up and login (email/password, social if available)
  • Idle session timeout configuration (simulate >24hr inactivity and verify session refresh/expiry mechanics)
  • Session revocation and concurrent session limit tests
• Ensure to keep the old supertokens setup files.
• Compare session reliability and developer ergonomics to current SuperTokens integration
• Document any SDK, dashboard, or config changes vs expectations from research
• Note any blockers for migration (e.g., user data export, password hashing, custom roles/RBAC edge cases)
• Deploy POC to staging

Acceptance Criteria

• Frontegg integration builds and runs on a test deployment
• All primary auth/session flows work (happy paths, session refresh, inactivity logout, role assignment)
• Idle session timeout works as configured (24h+ inactivity is tested, no silent refresh bug)
• Session revocation and session self-management (portal or API) function as expected
• Documentation covers setup, key config, results of idle session and concurrency tests

References

• Parent Epic: ✨ EPIC: Switch Authentication Provider: Research, Selection, and Migration #1209
• Frontegg Session Management Docs
• Internal: Past SuperTokens bug reports (see parent issue)

For full migration, see research/selection notes and cost analysis in parent epic.