Open-source Beyond Identity alternatives

authentik is an open-source Identity Provider for modern single sign-on. It supports SAML, OAuth2 and OpenID Connect, LDAP, RADIUS and more, and is designed for self-hosting at any scale, from a small lab to production clusters. A reverse-proxy mode also lets it protect applications that lack native SSO support.

The project positions its enterprise offering as a way for organizations to replace incumbent identity providers (Okta, Auth0, Entra ID or Ping Identity) in large-scale identity management. For installation, Docker Compose is recommended for small and test setups, a Helm chart for Kubernetes suits larger setups, and official templates exist for AWS CloudFormation and a one-click DigitalOcean Marketplace app.

The codebase is mostly Python with Kubernetes tooling, and the license is listed as 'Other' on GitHub because it mixes open-source and enterprise components, so check which features fall under which terms. authentik is a common choice for self-hosters and companies who want to centralize logins across internal tools without paying per-user fees to a hosted identity vendor.

Pocket ID is a self-hosted identity provider that speaks OpenID Connect and OAuth 2.0 and is described as OpenID Connect certified. Users sign in to your applications with passkeys, so there are no passwords to store, reset or leak, and a hardware key such as a YubiKey can unlock all of your self-hosted services.

Its goal is simplicity. The author notes that existing self-hosted providers like Keycloak or ORY Hydra are often too complex for simple use cases, and Pocket ID aims to be easy to set up and use. The distinctive design choice is that it supports only passkey authentication, which the project argues is the future, and a demo is available to try it.

The recommended installation is Docker, with a setup guide in the documentation. Pocket ID is written in Go and released under the BSD 2-Clause licence. It suits homelab users and small teams who want single sign-on across self-hosted applications without administering a heavyweight identity system.

Hanko is an authentication and user management solution released as open source, framework-agnostic and designed around privacy-first principles such as data minimalism and phishing resistance. It is presented as an alternative to Auth0, Clerk, WorkOS and Stytch, written in Go, with an API-first and lightweight design.

It supports modern sign-in methods including passwords, email passcodes, passkeys, MFA with TOTP and security keys, social logins such as Apple, Google and GitHub, custom OIDC and OAuth connections and SAML enterprise SSO. Configuration is flexible, for example passkey-only or OAuth-only setups, and passwords can be deletable by users. Hanko Elements web components make integration quick, a JS SDK is available, webhooks and server-side sessions with remote revocation are included, and a full API supports custom front ends. Organizations, roles and permissions plus mobile SDKs are on the roadmap.

You can self-host Hanko or use it as a fully managed service on Hanko Cloud. The repository lists the licence as Other, so review the licence file for the terms. It suits developers who want to own their authentication stack without building it from scratch.

privacyIDEA is an open-source authentication server that manages multi-factor authentication for an organization. It issues and verifies second factors such as one-time passwords, hardware tokens, push notifications and FIDO2 or WebAuthn security keys, so applications and servers can add two-factor login without each building its own token handling.

The server is written in Python and exposes an API that other systems can call to check a login attempt. Its topics point to support for OTP, passkeys, push authentication and certificates, and administrators enroll and manage tokens centrally rather than configuring every service by hand. The project documentation includes how-tos for running it behind Apache2 with MySQL and for protecting a whole server farm.

privacyIDEA is released under the AGPL-3.0 licence and can be self-hosted, which keeps token data and user policies on infrastructure you control. The project website also lists an Enterprise Edition next to the community version, along with a demo site, screenshots and community resources for anyone evaluating it.