Auth0 handles login, social sign-in, MFA, SSO and user management so you don't build them yourself. Open-source identity tools give you the same building blocks on your own infrastructure, without per-user pricing.
All nine projects are under OSI-approved licences (Apache-2.0, MIT, MPL-2.0 or AGPL-3.0) as shown in their repositories. Several are open-core, with enterprise code in separate folders under other licences, which we flag. Most can federate through OIDC and SAML, but the feature depth varies, so check the protocols you need.
Licences checked against each repository on November 7, 2026.
1. Keycloak
Apache-2.0Best for: The established full-featured identity server
Describes itself as open source identity and access management for modern applications and services. Provides user federation, strong authentication, user management and fine-grained authorisation, with OIDC and SAML support. Run with the distribution or the quay.io Docker image.
Strengths
- + User federation and fine-grained authorisation
- + OIDC and SAML
- + Docker image available
Trade-offs
- − Self-hosted, so you run upgrades and scaling yourself
2. authentik
MITBest for: Self-hosted SSO for apps and homelabs
An open-source identity provider for modern SSO supporting SAML, OAuth2/OIDC, LDAP and RADIUS. Install with Docker Compose, Helm, CloudFormation or a DigitalOcean one-click app.
Strengths
- + Many protocols including LDAP and RADIUS
- + Docker Compose and Helm installs
- + MIT licence
Trade-offs
- − The authentik/enterprise folder has its own EE licence
- − Enterprise edition sold separately
3. Ory Kratos
Apache-2.0Best for: API-first identity for your own login UI
An API-first identity and user management system for cloud native applications covering login, registration, recovery, verification and profile management. Supports MFA, passkeys and social sign-in.
Strengths
- + API-first, bring your own UI
- + Passkeys, MFA and social sign-in
- + Runs on Postgres, MySQL or CockroachDB
Trade-offs
- − Open-source build is aimed at experiments and non-critical workloads, per its docs
- − SCIM, SAML and organisation SSO need a paid Ory licence
4. ZITADEL
AGPL-3.0Best for: Multi-tenant IAM for B2B SaaS
An open-source identity and access management platform for teams that need more than basic auth. Offers SSO, passkeys, MFA, OIDC, SAML 2.0, SCIM 2.0, multi-tenancy and audit logs, on Postgres via Docker Compose or Kubernetes.
Strengths
- + Multi-tenancy and B2B onboarding
- + SCIM server and audit log
- + Same code on Cloud and self-hosted
Trade-offs
- − Some directories carry Apache-2.0 or MIT, see LICENSING.md
- − AGPL needs thought if you modify and distribute it
5. SuperTokens
Apache-2.0Best for: Embedded auth with frontend and backend SDKs
An open-core alternative to proprietary login providers like Auth0 or AWS Cognito, built from a frontend SDK, a backend SDK and a core service. Offers passwordless, social and email/password login, sessions, MFA and roles.
Strengths
- + SDKs make integration direct
- + Self-host with a JDK or Docker
- + User management dashboard
Trade-offs
- − Enterprise code in the ee directory is under a separate licence
- − Multi-tenancy and enterprise SSO are enterprise features
6. Logto
MPL-2.0Best for: Auth for SaaS with prebuilt flows
Describes itself as modern, open-source auth infrastructure for SaaS and AI apps, built on OIDC and OAuth 2.1 with multi-tenancy, SSO and RBAC. SDKs for 30+ frameworks. Run with Docker Compose or npm init.
Strengths
- + Prebuilt, customisable sign-in flows
- + Multi-tenancy and RBAC
- + SDKs for 30+ frameworks
Trade-offs
- − Managed Logto Cloud is also offered
7. Casdoor
Apache-2.0Best for: SSO with a web console and many protocols
A single sign-on and authentication server with a web console. Supports OAuth 2.0, OIDC, SAML 2.0, CAS, LDAP and SCIM 2.0, WebAuthn and Casbin-based policies.
Strengths
- + Wide protocol list
- + Web admin console
- + Docker, Helm and source installs
Trade-offs
- − Its all-in-one Docker image is for evaluation only
8. Better Auth
MITBest for: TypeScript apps that want auth as a library
A framework-agnostic authentication and authorisation framework for TypeScript, with a plugin ecosystem for features like 2FA and multi-tenancy.
Strengths
- + Lives inside your own codebase
- + Plugin ecosystem
- + MIT licence
Trade-offs
- − TypeScript-only
- − A library, not a standalone identity server
9. Hanko
AGPL-3.0Best for: Passkey-first login with drop-in components
Describes itself as an open source alternative to Auth0, Clerk, WorkOS and Stytch. Supports passwords, passcodes, passkeys, MFA, OAuth SSO and SAML enterprise SSO, with web components and a JS SDK.
Strengths
- + Passkeys and web components
- + Self-host or Hanko Cloud
- + MIT frontend packages
Trade-offs
- − Backend is AGPL-3.0, commercial licence on request
- − Organisations, roles and permissions are in progress
