Open-source Amazon Cognito alternatives

SuperTokens is an open-source authentication provider positioned as an alternative to Auth0, Firebase Auth and AWS Cognito. It adds secure login and session management to your apps, with SDKs for popular languages and frameworks such as Node.js, Go, Python, React and React Native.

Its architecture has three building blocks: a frontend SDK that manages session tokens and renders login UI widgets, a backend SDK that provides the APIs for sign-up, sign-in, sign-out and session refreshing, and the SuperTokens Core, an HTTP service in Java that implements the authentication logic and database operations used by the backend SDK. The feature list spans passwordless and social sign-in, email and phone with password, session handling, MFA, multi-tenant organizations with enterprise SSO, user roles, authentication between microservices, and a dashboard for managing users.

You can self-host the core to keep user data in your own database, or use the vendor's managed offering. The repository's license is listed as 'Other' on GitHub, because enterprise features sit under a separate license, so check which features you need. It suits teams that want to own authentication without building it from scratch.

ZITADEL is an identity and access management platform, open source, for teams that need more than basic login. It targets SaaS products, B2B platforms and self-hosted IAM stacks, and bundles single sign-on, multi-factor authentication, passkeys, OIDC, SAML and SCIM in an API-first design, with an emphasis on a mature multi-tenancy model.

A comparison table in the README sets it against FusionAuth, Keycloak and Auth0 or Okta on points such as open-source status, self-hosting, infrastructure-level tenants, native B2B organizations and a comprehensive event-stream audit trail. Topics list standards and features including OAuth 2, OpenID Connect, FIDO2, 2FA and passkeys. The positioning is that you can own the identity layer without vendor lock-in while still getting a polished product.

ZITADEL is written in Go and licensed under AGPL-3.0, with a website, chat, docs and blog. You can run it yourself or use the vendor's managed cloud. It suits developers and security teams building multi-tenant applications who want a self-hostable alternative to commercial identity providers.

Ory Hydra is an OAuth 2.0 authorization server and an implementation of OpenID Connect Core 1.0. It is designed as a standalone server without user management, so it connects to whatever identity provider you already use through a login and consent app, leaving you in control of the user interface.

It handles OAuth 2.0 and OpenID Connect flows, issues and validates tokens, manages clients, orchestrates login and consent flows and manages JWKS. The project says it is tuned for low latency and high throughput with modest resource use, and it is OpenID Certified. It works with any authentication endpoint, including Ory Kratos, and belongs to an ecosystem that also includes Oathkeeper for access proxying and Keto for access control policies.

Hydra is written in Go and licensed under Apache-2.0. You can consume it as a managed service on Ory Network or self-host it, and a quickstart, documentation and telemetry notes are provided in the repository.

Supabase Auth is an authentication and user management server written in Go. It powers Supabase's sign-in features by issuing JSON Web Tokens that downstream services, such as PostgREST with Row Level Security, can trust. It started from Netlify's GoTrue codebase, but both projects have diverged significantly. It is released under the MIT license.

Supported sign-in methods include email and password, magic links, phone numbers, and external providers such as Google, Apple, Facebook, and Discord. The server exposes an HTTP API for managing users and sessions, and its configuration is handled through environment variables in a .env file, with an example file provided.

The README walks through a quick start using a local Postgres database and has sections on running in production, configuration, and endpoints. The service can be used as part of the Supabase hosted platform or run on its own, which suits teams that want an open-source JWT-based identity service they can host themselves.

Authgear is an open-source authentication solution for consumer-facing applications, presented as an alternative to Auth0, Keycloak, Clerk, and Firebase Auth. It is written in Go and released under the Apache-2.0 license, and can be self-hosted or used on Authgear Cloud. SDKs and a management portal help developers get started in a few minutes.

Out-of-the-box features include passwordless login through magic link or one-time codes over email, SMS, and WhatsApp, passkeys, pre-built sign-up, login, and account settings pages, biometric login on iOS and Android, and two-factor authentication with TOTP, SMS, or email. It supports OIDC, OAuth 2.0, and SAML for SSO, enterprise connections such as ADFS and LDAP, and security features like audit logs, brute-force protection, and rate limits.

The Authgear Portal provides a web interface for user management and configuration, and an Admin API in GraphQL manages resources programmatically. It suits SaaS products and multi-app ecosystems that need flexible authentication without building it themselves.

Authorizer is an open-source authentication and authorization server written in Go that you can host yourself. Its pitch is that you bring your own database and stay in control of user data. It supports more than 13 backends, including Postgres, MySQL, SQLite, SQL Server, MariaDB, Cassandra, ScyllaDB, MongoDB, ArangoDB, DynamoDB, and Couchbase. It is released under the Apache-2.0 license.

From one place it offers OAuth 2.0 and OpenID Connect, social login, multi-factor authentication, magic links, role-based access control, webhooks, and email templates, and it ships with a built-in login page and an admin panel. Version 2 is configured entirely through command-line arguments and does not read .env files or operating system environment variables.

You can run it as a Docker image or micro-service in your own infrastructure, or deploy it quickly on Railway. It suits developers who want a hosted-auth style experience without lock-in and with a choice of database.