Open-source Stytch alternatives

SuperTokens is an open-source authentication provider positioned as an alternative to Auth0, Firebase Auth and AWS Cognito. It adds secure login and session management to your apps, with SDKs for popular languages and frameworks such as Node.js, Go, Python, React and React Native.

Its architecture has three building blocks: a frontend SDK that manages session tokens and renders login UI widgets, a backend SDK that provides the APIs for sign-up, sign-in, sign-out and session refreshing, and the SuperTokens Core, an HTTP service in Java that implements the authentication logic and database operations used by the backend SDK. The feature list spans passwordless and social sign-in, email and phone with password, session handling, MFA, multi-tenant organizations with enterprise SSO, user roles, authentication between microservices, and a dashboard for managing users.

You can self-host the core to keep user data in your own database, or use the vendor's managed offering. The repository's license is listed as 'Other' on GitHub, because enterprise features sit under a separate license, so check which features you need. It suits teams that want to own authentication without building it from scratch.

Logto is an open-source identity platform that handles sign-in, sign-up and access control so product teams do not have to build them from scratch. It is built on OpenID Connect and OAuth 2.1, with SAML also supported, and is aimed at SaaS products and AI or agent-based platforms that need production-ready authentication.

Out of the box it provides multi-tenancy and organizations with member invites and role-based access, enterprise SSO, and prebuilt sign-in flows with a customizable interface. Sign-in options include social login, passwordless methods, MFA and Google One Tap, and it can connect to external identity providers such as Google, Azure AD and Okta. SDKs cover more than 30 frameworks, among them React, Next.js, Angular, Vue, Flutter, Go and Python.

The core is licensed under MPL-2.0 and can be self-hosted by following the OSS installation guide or run locally for development. Logto Cloud offers the same product as a fully managed service. The project also advertises support for the Model Context Protocol and agent-style AI architectures.

Hanko is an authentication and user management solution released as open source, framework-agnostic and designed around privacy-first principles such as data minimalism and phishing resistance. It is presented as an alternative to Auth0, Clerk, WorkOS and Stytch, written in Go, with an API-first and lightweight design.

It supports modern sign-in methods including passwords, email passcodes, passkeys, MFA with TOTP and security keys, social logins such as Apple, Google and GitHub, custom OIDC and OAuth connections and SAML enterprise SSO. Configuration is flexible, for example passkey-only or OAuth-only setups, and passwords can be deletable by users. Hanko Elements web components make integration quick, a JS SDK is available, webhooks and server-side sessions with remote revocation are included, and a full API supports custom front ends. Organizations, roles and permissions plus mobile SDKs are on the roadmap.

You can self-host Hanko or use it as a fully managed service on Hanko Cloud. The repository lists the licence as Other, so review the licence file for the terms. It suits developers who want to own their authentication stack without building it from scratch.

Hexclave positions itself as infrastructure for the user side of an app: you pick the frontend, backend and database, and it manages everything around your users. That covers authentication, teams, permissions, API keys, payments, emails and analytics, packaged as a catalog of modules that you enable when your product needs them, all sharing one user model.

Authentication supports passkeys, OAuth and CLI auth, with methods toggled from the dashboard without code changes. Teams add workspaces, email invites and roles, while RBAC provides nested roles and a single permission check usable on server or client. API keys are auto-revoked if leaked and show their secret only once. Payments cover subscriptions, single charges and credit-based usage metering for individuals or teams, and emails cover transactional and marketing sends with an AI template editor.

Setup is designed around pasting one prompt into a coding agent, and a Hexclave Deploy offering can deploy the frontend, backend and database together. The code is TypeScript with Next.js, topics mention self-hosting and alternatives such as Auth0, Clerk, Supabase and PostHog, and the repository lists the licence as Other, so review the licence terms.

Authorizer is an open-source authentication and authorization server written in Go that you can host yourself. Its pitch is that you bring your own database and stay in control of user data. It supports more than 13 backends, including Postgres, MySQL, SQLite, SQL Server, MariaDB, Cassandra, ScyllaDB, MongoDB, ArangoDB, DynamoDB, and Couchbase. It is released under the Apache-2.0 license.

From one place it offers OAuth 2.0 and OpenID Connect, social login, multi-factor authentication, magic links, role-based access control, webhooks, and email templates, and it ships with a built-in login page and an admin panel. Version 2 is configured entirely through command-line arguments and does not read .env files or operating system environment variables.

You can run it as a Docker image or micro-service in your own infrastructure, or deploy it quickly on Railway. It suits developers who want a hosted-auth style experience without lock-in and with a choice of database.