SuperTokens is an open source authentication solution offering features like: Different types of login: Email / password, Passwordless (OTP or Magic link based).

SuperTokens.com

if so, what would i do about the compulsory requirement for a website domain on the backend?

Are you using only the session recipe or another recipe as well?

just session recipe for webapp and corresponding react native apps, with a node backend

I see. So you can set the websiteDomain value on the backend to the domain on your web app.

i was thinking that, but why can i do that? i guess i need to understand the appinfo better

would you set the origin to the webapp domain as well, for the cors headers?