Open-source Scalekit alternatives

ZITADEL is an identity and access management platform, open source, for teams that need more than basic login. It targets SaaS products, B2B platforms and self-hosted IAM stacks, and bundles single sign-on, multi-factor authentication, passkeys, OIDC, SAML and SCIM in an API-first design, with an emphasis on a mature multi-tenancy model.

A comparison table in the README sets it against FusionAuth, Keycloak and Auth0 or Okta on points such as open-source status, self-hosting, infrastructure-level tenants, native B2B organizations and a comprehensive event-stream audit trail. Topics list standards and features including OAuth 2, OpenID Connect, FIDO2, 2FA and passkeys. The positioning is that you can own the identity layer without vendor lock-in while still getting a polished product.

ZITADEL is written in Go and licensed under AGPL-3.0, with a website, chat, docs and blog. You can run it yourself or use the vendor's managed cloud. It suits developers and security teams building multi-tenant applications who want a self-hostable alternative to commercial identity providers.

Logto is an open-source identity platform that handles sign-in, sign-up and access control so product teams do not have to build them from scratch. It is built on OpenID Connect and OAuth 2.1, with SAML also supported, and is aimed at SaaS products and AI or agent-based platforms that need production-ready authentication.

Out of the box it provides multi-tenancy and organizations with member invites and role-based access, enterprise SSO, and prebuilt sign-in flows with a customizable interface. Sign-in options include social login, passwordless methods, MFA and Google One Tap, and it can connect to external identity providers such as Google, Azure AD and Okta. SDKs cover more than 30 frameworks, among them React, Next.js, Angular, Vue, Flutter, Go and Python.

The core is licensed under MPL-2.0 and can be self-hosted by following the OSS installation guide or run locally for development. Logto Cloud offers the same product as a fully managed service. The project also advertises support for the Model Context Protocol and agent-style AI architectures.

Hanko is an authentication and user management solution released as open source, framework-agnostic and designed around privacy-first principles such as data minimalism and phishing resistance. It is presented as an alternative to Auth0, Clerk, WorkOS and Stytch, written in Go, with an API-first and lightweight design.

It supports modern sign-in methods including passwords, email passcodes, passkeys, MFA with TOTP and security keys, social logins such as Apple, Google and GitHub, custom OIDC and OAuth connections and SAML enterprise SSO. Configuration is flexible, for example passkey-only or OAuth-only setups, and passwords can be deletable by users. Hanko Elements web components make integration quick, a JS SDK is available, webhooks and server-side sessions with remote revocation are included, and a full API supports custom front ends. Organizations, roles and permissions plus mobile SDKs are on the roadmap.

You can self-host Hanko or use it as a fully managed service on Hanko Cloud. The repository lists the licence as Other, so review the licence file for the terms. It suits developers who want to own their authentication stack without building it from scratch.

Hexclave positions itself as infrastructure for the user side of an app: you pick the frontend, backend and database, and it manages everything around your users. That covers authentication, teams, permissions, API keys, payments, emails and analytics, packaged as a catalog of modules that you enable when your product needs them, all sharing one user model.

Authentication supports passkeys, OAuth and CLI auth, with methods toggled from the dashboard without code changes. Teams add workspaces, email invites and roles, while RBAC provides nested roles and a single permission check usable on server or client. API keys are auto-revoked if leaked and show their secret only once. Payments cover subscriptions, single charges and credit-based usage metering for individuals or teams, and emails cover transactional and marketing sends with an AI template editor.

Setup is designed around pasting one prompt into a coding agent, and a Hexclave Deploy offering can deploy the frontend, backend and database together. The code is TypeScript with Next.js, topics mention self-hosting and alternatives such as Auth0, Clerk, Supabase and PostHog, and the repository lists the licence as Other, so review the licence terms.

Frontier is an all-in-one user management platform from Raystack that combines identity, access control and billing. It is intended for teams that want to manage authentication and authorization across several applications and services from one server they control. The repository describes it as an open-source alternative to Clerk and WorkOS.

Core capabilities include user, organization, project and group management, so multiple tenants can each have their own users, applications and services. Authentication supports email one-time passwords and social login for people, and API keys or RSA JWT credentials for machine users. Authorization uses role-based access control with policies that bind a user to an access level. Billing and subscription management, audit logs of user activity and access events, and reporting are also included.

Frontier is written in Go and licensed under Apache-2.0. It can be installed as a cross-platform binary from the releases page and runs on macOS, Windows, Linux and the BSDs. The project provides introduction, concepts and API reference documentation. Because it is self-hosted, you run and secure the server yourself.

SSOReady, a Y Combinator-backed project, is a developer-focused tool for adding enterprise SSO and directory sync features to a product without building SAML and SCIM support from scratch. It is aimed at B2B SaaS companies whose enterprise customers require SAML-based single sign-on or SCIM-based user provisioning before they will sign a contract.

It provides SSOReady SAML for enterprise single sign-on, SSOReady SCIM for enterprise directory sync, and a self-serve setup UI that customers use to onboard themselves onto SAML or SCIM. SSOReady is stack-agnostic, working as a thin authentication middleware layer over a plain HTTP API, with official SDKs for TypeScript, Python, Go, Java, C#, Ruby and PHP; it does not take ownership of a product's user database or require schema changes.

SSOReady can be used through a cloud-hosted instance or self-hosted, with most integrations completing in about an afternoon using roughly two lines of code. An Enterprise plan adds SLA-backed support (for both hosted and self-hosted deployments), custom domains and branding, and a management API for fully automating SAML and SCIM configuration at scale. It is written in TypeScript and released under the MIT license.