Open-source Auth0 alternatives

Keycloak is an open-source identity and access management server. It lets application teams add authentication and secure services without building their own login system, since Keycloak handles storing users and authenticating them. The project is written in Java, released under the Apache-2.0 license and governed under the Cloud Native Computing Foundation code of conduct.

Keycloak supports standard protocols such as OpenID Connect and SAML, and offers user federation, strong authentication, user management and fine-grained authorization. You can run it from the downloadable distribution using a start-dev command, or use the official Docker image published on Quay for containers and Kubernetes setups. The project provides documentation, a user mailing list and community channels for help, along with guidance for building and testing from source.

authentik is an open-source Identity Provider for modern single sign-on. It supports SAML, OAuth2 and OpenID Connect, LDAP, RADIUS and more, and is designed for self-hosting at any scale, from a small lab to production clusters. A reverse-proxy mode also lets it protect applications that lack native SSO support.

The project positions its enterprise offering as a way for organizations to replace incumbent identity providers (Okta, Auth0, Entra ID or Ping Identity) in large-scale identity management. For installation, Docker Compose is recommended for small and test setups, a Helm chart for Kubernetes suits larger setups, and official templates exist for AWS CloudFormation and a one-click DigitalOcean Marketplace app.

The codebase is mostly Python with Kubernetes tooling, and the license is listed as 'Other' on GitHub because it mixes open-source and enterprise components, so check which features fall under which terms. authentik is a common choice for self-hosters and companies who want to centralize logins across internal tools without paying per-user fees to a hosted identity vendor.

SuperTokens is an open-source authentication provider positioned as an alternative to Auth0, Firebase Auth and AWS Cognito. It adds secure login and session management to your apps, with SDKs for popular languages and frameworks such as Node.js, Go, Python, React and React Native.

Its architecture has three building blocks: a frontend SDK that manages session tokens and renders login UI widgets, a backend SDK that provides the APIs for sign-up, sign-in, sign-out and session refreshing, and the SuperTokens Core, an HTTP service in Java that implements the authentication logic and database operations used by the backend SDK. The feature list spans passwordless and social sign-in, email and phone with password, session handling, MFA, multi-tenant organizations with enterprise SSO, user roles, authentication between microservices, and a dashboard for managing users.

You can self-host the core to keep user data in your own database, or use the vendor's managed offering. The repository's license is listed as 'Other' on GitHub, because enterprise features sit under a separate license, so check which features you need. It suits teams that want to own authentication without building it from scratch.

ZITADEL is an identity and access management platform, open source, for teams that need more than basic login. It targets SaaS products, B2B platforms and self-hosted IAM stacks, and bundles single sign-on, multi-factor authentication, passkeys, OIDC, SAML and SCIM in an API-first design, with an emphasis on a mature multi-tenancy model.

A comparison table in the README sets it against FusionAuth, Keycloak and Auth0 or Okta on points such as open-source status, self-hosting, infrastructure-level tenants, native B2B organizations and a comprehensive event-stream audit trail. Topics list standards and features including OAuth 2, OpenID Connect, FIDO2, 2FA and passkeys. The positioning is that you can own the identity layer without vendor lock-in while still getting a polished product.

ZITADEL is written in Go and licensed under AGPL-3.0, with a website, chat, docs and blog. You can run it yourself or use the vendor's managed cloud. It suits developers and security teams building multi-tenant applications who want a self-hostable alternative to commercial identity providers.

Logto is an open-source identity platform that handles sign-in, sign-up and access control so product teams do not have to build them from scratch. It is built on OpenID Connect and OAuth 2.1, with SAML also supported, and is aimed at SaaS products and AI or agent-based platforms that need production-ready authentication.

Out of the box it provides multi-tenancy and organizations with member invites and role-based access, enterprise SSO, and prebuilt sign-in flows with a customizable interface. Sign-in options include social login, passwordless methods, MFA and Google One Tap, and it can connect to external identity providers such as Google, Azure AD and Okta. SDKs cover more than 30 frameworks, among them React, Next.js, Angular, Vue, Flutter, Go and Python.

The core is licensed under MPL-2.0 and can be self-hosted by following the OSS installation guide or run locally for development. Logto Cloud offers the same product as a fully managed service. The project also advertises support for the Model Context Protocol and agent-style AI architectures.

Casdoor is a self-hosted identity and access management platform with a web console. It acts as a single sign-on and authentication server, so applications can delegate login to it instead of implementing their own user management, sessions and password handling.

Supported protocols include OIDC, OAuth 2.0, SAML 2.0, LDAP, CAS and SCIM 2.0, alongside WebAuthn, TOTP and MCP, and it can connect to identity providers such as Google Workspace, Microsoft Entra ID and GitHub. Sign-in options include passwords, email or SMS codes, WebAuthn and Face ID, plus any social providers you enable. The admin console covers users, tokens, organizations, providers and applications, and settings change without a redeploy or config file.

Casdoor is written in Go and licensed under Apache-2.0. A quick trial runs on SQLite with sample data and needs no separate database or config file. Its newer positioning emphasizes AI agents, with an MCP and agent gateway for LLM tooling, and hosted demo instances are available for trying it before installing.

Dex is an identity service that uses OpenID Connect to handle authentication for other applications. Rather than storing users itself, it acts as a portal to other identity providers through connectors, so apps only need to implement one authentication flow and let Dex deal with each backend's protocol.

Connectors let it defer login to LDAP servers, SAML providers, and established providers such as GitHub, Google and Active Directory. Its primary output is the ID Token, a JSON Web Token signed by Dex that states which client logged the user in, when the token expires and who the user is. Because these tokens follow standard claims, other services such as Kubernetes and AWS STS can consume them.

Dex runs natively on Kubernetes using Custom Resource Definitions and can drive API server authentication through the OpenID Connect plugin, with clients like kubelogin and kubectl logging users in through any supported provider. The project is written in Go, licensed under Apache-2.0, and you deploy and operate it yourself.

Pocket ID is a self-hosted identity provider that speaks OpenID Connect and OAuth 2.0 and is described as OpenID Connect certified. Users sign in to your applications with passkeys, so there are no passwords to store, reset or leak, and a hardware key such as a YubiKey can unlock all of your self-hosted services.

Its goal is simplicity. The author notes that existing self-hosted providers like Keycloak or ORY Hydra are often too complex for simple use cases, and Pocket ID aims to be easy to set up and use. The distinctive design choice is that it supports only passkey authentication, which the project argues is the future, and a demo is available to try it.

The recommended installation is Docker, with a setup guide in the documentation. Pocket ID is written in Go and released under the BSD 2-Clause licence. It suits homelab users and small teams who want single sign-on across self-hosted applications without administering a heavyweight identity system.

Hanko is an authentication and user management solution released as open source, framework-agnostic and designed around privacy-first principles such as data minimalism and phishing resistance. It is presented as an alternative to Auth0, Clerk, WorkOS and Stytch, written in Go, with an API-first and lightweight design.

It supports modern sign-in methods including passwords, email passcodes, passkeys, MFA with TOTP and security keys, social logins such as Apple, Google and GitHub, custom OIDC and OAuth connections and SAML enterprise SSO. Configuration is flexible, for example passkey-only or OAuth-only setups, and passwords can be deletable by users. Hanko Elements web components make integration quick, a JS SDK is available, webhooks and server-side sessions with remote revocation are included, and a full API supports custom front ends. Organizations, roles and permissions plus mobile SDKs are on the roadmap.

You can self-host Hanko or use it as a fully managed service on Hanko Cloud. The repository lists the licence as Other, so review the licence file for the terms. It suits developers who want to own their authentication stack without building it from scratch.

Ory Hydra is an OAuth 2.0 authorization server and an implementation of OpenID Connect Core 1.0. It is designed as a standalone server without user management, so it connects to whatever identity provider you already use through a login and consent app, leaving you in control of the user interface.

It handles OAuth 2.0 and OpenID Connect flows, issues and validates tokens, manages clients, orchestrates login and consent flows and manages JWKS. The project says it is tuned for low latency and high throughput with modest resource use, and it is OpenID Certified. It works with any authentication endpoint, including Ory Kratos, and belongs to an ecosystem that also includes Oathkeeper for access proxying and Keto for access control policies.

Hydra is written in Go and licensed under Apache-2.0. You can consume it as a managed service on Ory Network or self-host it, and a quickstart, documentation and telemetry notes are provided in the repository.