What is MaxKey used for?

MaxKey is a Java identity and access management product offering single sign-on with OAuth 2, OpenID Connect, SAML, CAS, JWT, and SCIM, plus RBAC and user lifecycle management. It is a good fit for enterprise single sign-on, and centralized identity and access management for internal systems.

Is MaxKey open source?

Yes. MaxKey is open source under the Apache-2.0 licence. Its source code is on GitHub at dromara/MaxKey and is written mainly in Java.

Yes. MaxKey is open source, so the software itself is free to use.

Can I self-host MaxKey?

Yes. MaxKey can be self-hosted on your own server or infrastructure.

What is MaxKey an alternative to?

MaxKey is an open-source alternative to OneLogin, Ping Identity, Microsoft Entra ID and Okta. Other open-source alternatives to OneLogin include Keycloak, OpenAM and WSO2 Identity Server.

Is MaxKey actively maintained?

Yes. The most recent commit to MaxKey was on 23 September 2026, and the latest release is 4.1.12, published on 30 June 2026. The project has 2k stars on GitHub.

MaxKey: open-source alternative to OneLogin, Ping Identity

About MaxKey

MaxKey, from the Dromara community, is an IAM and IDaaS product written in Java and released under the Apache-2.0 license. It provides single sign-on, identity management, access management, RBAC-based permission control, and resource management. The name is a homophone of a phrase about a master key that unlocks enterprise security needs, according to the README.

It supports standard protocols including OAuth 2.x and OpenID Connect, SAML 2.0, CAS, JWT, and SCIM, and its topics also list LDAP, Active Directory, Kerberos, multi-factor authentication, TOTP, and multi-tenancy. Features focus on user lifecycle management and compliance, and the project presents itself as open, secure, and self-controlled. Documentation is in English and Chinese.

MaxKey is aimed at enterprises, particularly in Chinese-speaking markets, that need a self-hosted alternative to commercial identity platforms. Teams should confirm industry claims in the README against their own requirements.

Key features

Single sign-on across applications
OAuth 2.x, OpenID Connect, SAML 2.0, and CAS
SCIM provisioning and user lifecycle management
RBAC permission management
LDAP, Active Directory, and MFA integration
Multi-tenancy support

Good fit for

→Enterprise single sign-on
→Centralized identity and access management for internal systems

Built with: Java
Tags: iam; sso; oidc; saml; oauth2; scim; rbac; java

MaxKey: questions and answers

What is MaxKey used for?: MaxKey is a Java identity and access management product offering single sign-on with OAuth 2, OpenID Connect, SAML, CAS, JWT, and SCIM, plus RBAC and user lifecycle management. It is a good fit for enterprise single sign-on, and centralized identity and access management for internal systems.
Is MaxKey open source?: Yes. MaxKey is open source under the Apache-2.0 licence. Its source code is on GitHub at dromara/MaxKey and is written mainly in Java.
Is MaxKey free?: Yes. MaxKey is open source, so the software itself is free to use.
Can I self-host MaxKey?: Yes. MaxKey can be self-hosted on your own server or infrastructure.
What is MaxKey an alternative to?: MaxKey is an open-source alternative to OneLogin, Ping Identity, Microsoft Entra ID and Okta. Other open-source alternatives to OneLogin include Keycloak, OpenAM and WSO2 Identity Server.
Is MaxKey actively maintained?: Yes. The most recent commit to MaxKey was on 23 September 2026, and the latest release is 4.1.12, published on 30 June 2026. The project has 2k stars on GitHub.