Alternatives to Auth0 in 2026

Keycloak keycloak

Open Source Identity and Access Management For Modern Applications and Services

Building block Production-ready You need self-hosted SSO across many applications with enterprise protocols and no licence fees.

★ 38k Apache-2.0 Java Active, pushed today

Better Auth better-auth

The most comprehensive authentication framework

Building block Production-ready You are building a TypeScript web app and want auth in your own codebase and database instead of a hosted service.

★ 31k MIT TypeScript Active, pushed yesterday

Authelia authelia

The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.

Complete system Production-ready You self-host several web apps behind Nginx, Traefik or Caddy and want one login with MFA in front of them.

★ 29k Apache-2.0 Go Active, pushed today

Devise heartcombo

Flexible authentication solution for Rails with Warden.

Building block Production-ready You are building a Rails app with conventional email and password accounts.

★ 24k MIT Ruby Active, pushed 27 days ago

Casbin apache

Apache Casbin: an authorization library that supports access control models like ACL, RBAC, ABAC.

Building block Production-ready Your application needs configurable permission rules without writing an authorisation engine.

★ 20k Apache-2.0 Go Active, pushed today

openGym DuarteSantos8

Open-source gym & body-weight tracker, now in the App Store (iPhone + Apple Watch) and as an Android APK. Plan routines, log workouts, see which muscles are trained, import from Strong/Hevy/FitNotes. Self-host it or use it on the phone alone.

Complete system Experimental You want a free workout log you can self-host or keep on your phone, without a subscription app.

★ 19k AGPL-3.0 JavaScript Active, pushed today

ZITADEL zitadel

ZITADEL - Identity infrastructure, simplified for you.

Building block Production-ready You build a B2B SaaS that needs per-customer organisations and SSO without assembling it yourself.

★ 16k AGPL-3.0 Go Active, pushed today

Logto logto-io

🧑‍🚀 Authentication and authorization infrastructure for SaaS and AI apps, built on OIDC and OAuth 2.1 with multi-tenancy, SSO, and RBAC.

Building block Production-ready You want an Auth0-like service with ready sign-in screens that you can self-host or use as cloud.

★ 15k MPL-2.0 TypeScript Active, pushed today

Casdoor casdoor

An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD

Complete system Production-ready You want a self-hosted SSO and user management server that is simpler to run than Keycloak.

★ 15k Apache-2.0 Go Active, pushed today

OPA open-policy-agent

Open Policy Agent (OPA) is an open source, general-purpose policy engine.

Building block Production-ready You want one policy language across Kubernetes, CI, APIs and infrastructure, with policies kept outside application code.

★ 12k Apache-2.0 Go Active, pushed today

CAS apereo

Apereo CAS - Identity & Single Sign On for all earthlings and beyond.

Complete system Production-ready A university or large organisation needs a self-hosted SSO hub across many legacy and modern apps.

★ 11k Apache-2.0 Java Active, pushed today

Dex dexidp

OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors

Building block Production-ready You need a lightweight OIDC front for existing identity providers, especially for Kubernetes and internal tools.

★ 11k Apache-2.0 Go Active, pushed today

Django-allauth pennersr

Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication. 🔁 Mirror of https://codeberg.org/allauth/django-allauth/

Building block Production-ready You build a Django site that needs user accounts and social or SSO login.

★ 10k MIT Python Active, pushed 3 days ago

Pocket ID pocket-id

The most user-friendly OpenID Connect Certified™ and OAuth 2.0 provider that lets users sign in to your applications with passkeys.

Building block Usable You want single sign-on with passkeys for a homelab or small team without Keycloak's complexity.

★ 9.9k BSD-2-Clause Go Active, pushed today

Hanko teamhanko

Modern authentication, on your terms. Open source alternative to Auth0, Clerk, WorkOS, Stytch.

Complete system Usable You want passkey-first login with drop-in UI components and the option to self-host.

★ 9.1k AGPL-3.0 Go Active, pushed today

SpiceDB authzed

Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data

Building block Production-ready Your app needs fine-grained, relationship-based permissions such as sharing, teams and nested folders across services.

★ 7.2k Apache-2.0 Go Active, pushed yesterday

CASL stalniy

CASL is an isomorphic authorization JavaScript library which restricts what resources a given user is allowed to access

Building block Production-ready You need the same permission rules in front end and back end of a JavaScript app.

★ 7.1k MIT TypeScript Active, pushed today

Oauth2-server thephpleague

A spec compliant, secure by default PHP OAuth 2.0 Server

Building block Production-ready You need to issue OAuth tokens from a PHP application; Laravel Passport is built on it.

★ 6.7k MIT PHP Active, pushed 9 days ago

Lldap lldap

Light LDAP implementation

Building block Usable Your homelab or small office needs a central user directory and full OpenLDAP is overkill.

★ 6.6k GPL-3.0 Rust Active, pushed 37 days ago

Next-auth nextauthjs

Authentication for the Web.

Building block Production-ready You maintain an existing Next.js app on NextAuth or need stateless sessions without a database.

★ 28k ISC TypeScript Slowing, pushed 3 months ago

OpenFGA openfga

A high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

Building block Production-ready You need fine-grained permissions as a separate service and want a vendor-neutral, CNCF-governed option.

★ 6.1k Apache-2.0 Go Active, pushed today

Permify Permify

An open-source authorization as a service inspired by Google Zanzibar, designed to build and manage fine-grained and scalable authorization systems for any application. — Permify is now part of FusionAuth 🎉

Building block Usable You want a fine-grained permission service with a readable schema and testing tools.

★ 6k AGPL-3.0 Go Active, pushed yesterday

Doorkeeper doorkeeper-gem

Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape.

Building block Production-ready Your Rails app needs to offer an OAuth API to third-party or mobile clients.

★ 5.5k MIT Ruby Active, pushed today

Kanidm kanidm

Kanidm: A simple, secure, and fast identity management platform

Complete system Usable You want a modern self-hosted replacement for FreeIPA or OpenLDAP to manage people and Linux logins.

★ 5.5k MPL-2.0 Rust Active, pushed today

Authlib authlib

The ultimate Python library in building OAuth, OpenID Connect clients and servers. JWS, JWE, JWK, JWA, JWT included.

Building block Production-ready You implement OAuth or OIDC in Python, either consuming providers or running your own server.

★ 5.4k BSD-3-Clause Python Active, pushed today

Keto ory

The most scalable and customizable permission server on the market. Fix your slow or broken permission system with Google's proven "Zanzibar" approach. Supports ACL, RBAC, and more. Written in Go, cloud native, headless, API-first. Available as a service on Ory Network and for self-hosters.

Building block Usable You already use Ory Kratos or Hydra and want permissions from the same stack.

★ 5.4k Apache-2.0 Go Active, pushed 2 months ago

Cerbos cerbos

Cerbos is an open-core authorization management platform for authorizing every identity and governing every action across applications, gateways, workloads, and AI agents.

Building block Production-ready You want authorization rules out of application code but do not want to sync relationship data into another database.

★ 4.6k Apache-2.0 Go Active, pushed today

Hydra ory

Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go.

Building block Production-ready You already have user accounts and need a standards-compliant OAuth2/OIDC provider in front of them.

★ 18k Apache-2.0 Go Slowing, pushed 3 months ago

Node-oidc-provider panva

OpenID Certified™ OAuth 2.0 Authorization Server implementation for Node.js

Building block Production-ready You need your Node.js app to act as a standards-compliant identity provider.

★ 3.8k MIT JavaScript Active, pushed today

Oauth2 go-oauth2

OAuth 2.0 server library for the Go programming language.

Building block Usable You need a basic OAuth 2.0 token server embedded in a Go service.

★ 3.6k MIT Go Active, pushed 2 months ago

OpenSK google

OpenSK is an open-source implementation for security keys written in Rust that supports both FIDO U2F and FIDO2 standards.

Building block Experimental You research security keys or build your own hardware token for experimentation.

★ 3.5k Apache-2.0 Rust Active, pushed 4 days ago

Kratos ory

Headless cloud-native authentication and identity management written in Go. Scales to a billion+ users. Replace Homegrown, Auth0, Okta, Firebase with better UX and DX. Passkeys, Social Sign In, OIDC, Magic Link, Multi-Factor Auth, SMS, SAML, TOTP, and more. Runs everywhere, runs best on Ory Network.

Building block Production-ready You want to own your login system and build your own UI on top, rather than use a hosted provider's screens.

★ 14k Apache-2.0 Go Slowing, pushed 3 months ago

SyncTV synctv-org

Synchronized viewing, theater, live streaming, video

Complete system Usable You want to watch videos in sync with friends on your own server.

★ 2.5k MIT Rust Active, pushed today

SimpleWebAuthn MasterKale

WebAuthn, Simplified. A collection of TypeScript-first libraries for simpler WebAuthn integration. Supports modern browsers, Node, Deno, and more.

Building block Production-ready You add passkey login to a JavaScript or TypeScript app and want the WebAuthn details handled.

★ 2.4k MIT TypeScript Active, pushed 5 days ago

Caddy-security greenpau

🔐 Authentication, Authorization, and Accounting (AAA) App and Plugin for Caddy v2. 💎 Implements Form-Based, Basic, Local, LDAP, OpenID Connect, OAuth 2.0 (Github, Google, Facebook, Okta, etc.), SAML Authentication. MFA/2FA with App Authenticators and Yubico. 💎 Authorization with JWT/PASETO tokens. 🔐

Integration Usable You already use Caddy and want authentication at the proxy without running a separate SSO server.

★ 2.3k Apache-2.0 Go Active, pushed 6 days ago

Authgear-server authgear

Open source Auth0/Keycloak alternative. Passkeys, SSO, MFA, passwordless, biometric login. Self-hosted or cloud. Enterprise-ready for SaaS & mobile apps

Complete system Usable A SaaS or mobile app team wants Auth0-style customer login it can self-host or buy as cloud.

★ 2.1k Apache-2.0 Go Active, pushed today

MaxKey dromara

Dromara MaxKey 🗝️ SSO ,Leading-Edge IAM-IDaas(Identity and Access Management) Product , Under Apache-2.0 is free ，业界领先的IAM-IDaas身份管理和认证产品，遵循Apache-2.0开源免费，支持OAuth2.x、OpenID Connect、SAML2.0、CAS、JWT、SCIM等SSO标准协议，基于RBAC统一权限控制，实现用户生命周期管理，开源、安全、合规、自主可控。

Complete system Production-ready A Chinese organisation needs self-hosted SSO and identity management that meets domestic compliance needs.

★ 2k Apache-2.0 Java Active, pushed 6 days ago

privacyIDEA privacyidea

:closed_lock_with_key: multi factor authentication system (2FA, MFA, OTP, FIDO Server)

Complete system Production-ready An organisation needs on-premises MFA across VPNs, Windows logins and applications under its own control.

★ 1.8k AGPL-3.0 Python Active, pushed today

Fido2-net-lib passwordless-lib

Passkeys, FIDO2 and WebAuthn .NET library.

Building block Production-ready You add passkey authentication to a .NET application.

★ 1.5k MIT C# Active, pushed 5 days ago

Rauthy sebadob

Single Sign-On Identity & Access Management via OpenID Connect, OAuth 2, PAM

Complete system Usable You want a small, low-resource OIDC provider for self-hosted apps instead of Keycloak.

★ 1.4k Apache-2.0 Rust Active, pushed 3 days ago

Topaz aserto-dev

Cloud-native authorization for modern applications and APIs

Building block Usable You want OPA-based policies plus relationship data in one local authorizer.

★ 1.4k Apache-2.0 Go Active, pushed 3 days ago

WebAuthn go-webauthn

FIDO2 Conformant WebAuthn and Passkey backend library for golang

Building block Production-ready You add passkey login to a Go server.

★ 1.4k BSD-3-Clause Go Active, pushed 5 days ago

FreeIPA freeipa

Mirror of FreeIPA, an integrated security information management solution

Complete system Production-ready You manage many Linux servers and need centralised logins, sudo rules and certificates, often alongside Active Directory.

★ 1.3k GPL-3.0 Python Active, pushed today

ArkID longguikeji

一账通是一款开源的统一身份认证授权管理解决方案，支持多种标准协议(LDAP, OAuth2, SAML, OpenID)，细粒度权限控制，完整的WEB管理功能，钉钉、企业微信集成等，QQ group: 167885406

Complete system Usable A Chinese organisation needs SSO across internal apps and integration with DingTalk or WeCom.

★ 1.3k AGPL-3.0 Python Active, pushed 13 days ago

Yubikey-manager Yubico

Python library and command line tool for configuring any YubiKey over all USB interfaces.

Developer tool Production-ready You set up or administer YubiKeys from scripts or the terminal.

★ 1.2k BSD-2-Clause Python Active, pushed 4 days ago

Py_webauthn duo-labs

Pythonic WebAuthn 🐍

Building block Production-ready You add passkey login to a Python web app.

★ 1.1k BSD-3-Clause Python Active, pushed 25 days ago

WebAuthn ruby cedarcode

WebAuthn ruby server library ― Make your Ruby/Rails web server become a conformant WebAuthn Relying Party

Building block Production-ready You add passkey or security-key login to a Ruby app.

★ 777 MIT Ruby Active, pushed 10 days ago

TheIdServer Aguafrommars

OpenID/Connect, OAuth2, WS-Federation and SAML 2.0 server based on Duende IdentityServer and ITFoxtec Identity SAML 2.0 with its admin UI

Complete system Usable A .NET shop wants an IdentityServer-based provider with a ready admin interface.

★ 756 Apache-2.0 C# Active, pushed today

Webauthn.io duo-labs

The source code for webauthn.io, a demonstration of WebAuthn.

Template or starter Usable You want a reference implementation to learn how WebAuthn ceremonies work in practice.

★ 746 BSD-3-Clause Python Active, pushed 3 months ago

Webauthn-rs kanidm

An implementation of webauthn components for Rustlang servers

Building block Usable You add passkey authentication to a Rust web service.

★ 717 MPL-2.0 Rust Active, pushed 4 days ago

Polis ory

Streamline your web application's authentication with Polis, an SSO service supporting SAML and OpenID Connect protocols. Beyond enterprise-grade Single Sign-On, it also supports Directory Sync via the SCIM 2.0 protocol for automatic user and group provisioning/de-provisioning.

Building block Production-ready Enterprise customers ask your SaaS for SAML SSO and SCIM and you do not want to switch identity providers.

★ 2.3k Apache-2.0 TypeScript Slowing, pushed 3 months ago

Melody Auth ValueMelody

A turnkey OAuth & authentication system, designed for both Cloudflare Workers and Node.js

Complete system Usable You want your own auth server on Cloudflare's edge without paying for Auth0.

★ 651 MIT TypeScript Active, pushed 7 days ago

Warrant warrant-dev

Warrant is a highly scalable, centralized authorization service based on Google Zanzibar. Use it to define, enforce, query, and audit application authorization and access control.

Building block Usable Only if you already run it; new projects are better served by SpiceDB or OpenFGA.

★ 1.3k Apache-2.0 Go Slowing, pushed 11 months ago

AspNetSaml jitbit

Very simple SAML 2.0 consumer module for ASP.NET/C#

Building block Production-ready You need to add basic SAML login to a .NET app without a heavy library.

★ 418 Apache-2.0 C# Active, pushed 6 days ago

Play-pac4j pac4j

Security library for Play framework 2/3 in Java and Scala: OpenID Connect, SAML2, CAS, OAuth, LDAP, JWT...

Integration Production-ready You build on Play and need multiple authentication protocols.

★ 414 Apache-2.0 Java Active, pushed 8 days ago

Syncope apache

Apache Syncope

Complete system Production-ready An enterprise needs open-source identity lifecycle management and provisioning, not just login.

★ 346 Apache-2.0 Java Active, pushed today

Hass-openid cavefire

OIDC integration for Home Assistant

Integration Usable You run Home Assistant with a self-hosted SSO provider and want single sign-on.

★ 214 GPL-3.0 Python Active, pushed 23 days ago

Goiabada leodip

Goiabada is an OAuth2 / OpenID Connect server written in Go.

Complete system Usable You need a small, understandable auth server for a few apps and find Keycloak too heavy.

★ 204 MIT Go Active, pushed today

Boruta-server malach-it

Identity and Access Management server, manage authentication, authorization and access control up to decentralized identity

Complete system Experimental You run Elixir infrastructure or need verifiable credentials and want an auth server in the same ecosystem.

★ 194 Apache-2.0 Elixir Active, pushed today

Open.IdentityServer RockSolidKnowledge

A free open source OpenID Connect and OAuth 2.0 framework for ASP.NET Core, based on IdentityServer4

Building block Usable You run IdentityServer4 and want a maintained Apache-licensed path instead of buying Duende IdentityServer.

★ 189 Apache-2.0 C# Active, pushed today

FusionDirectory fusiondirectory

FusionDirectory is a modern, efficient and secure Identity Management (IAM) solution.

Complete system Usable Your organisation runs OpenLDAP and administrators need a web UI to manage it.

★ 189 GPL-2.0 PHP Active, pushed 29 days ago

Jellyfin-plugin-sso K0lin

This plugin allows users to sign in through an SSO provider (such as Google, Microsoft, or your own provider). This enables one-click signin.

Integration Usable You run Jellyfin for family or a small group and already use an SSO provider.

★ 180 GPL-3.0 C# Active, pushed today

SPIKE spiffe

SPIKE is a lightweight secrets store that uses SPIFFE as its identity control plane. It protects your secrets and helps your ops, SREs, and sysadmins manage sensitive data securely with minimal overhead.

Complete system Experimental You already use SPIFFE or SPIRE for workload identity and want secrets management that plugs into it.

★ 180 Apache-2.0 Go Active, pushed 43 days ago

Spark-pac4j pac4j

Security library for Sparkjava: OpenID Connect, SAML2, CAS, OAuth, LDAP, JWT...

Integration Usable You maintain a Spark Java app and need standard authentication protocols.

★ 163 Apache-2.0 Java Active, pushed 7 days ago

Guardian dream-horizon-org

Complete system Experimental You want a self-hosted consumer login service in Java and accept an early project.

★ 141 MIT Java Active, pushed yesterday

Melange pthm

OpenFGA-to-PostgreSQL authorization compiler. Generates specialized SQL functions from .fga schemas that query your existing tables. Zero sync, always consistent.

Developer tool Experimental You like OpenFGA's model but want permission checks inside Postgres without syncing a separate store.

★ 107 MIT Go Active, pushed today

GrantForge devlive-community

GrantForge (formerly AuthX) is an open-source (MIT) unified permission platform. It answers two questions in one place: who can do what (functional authorization) and who can see which data (data and field authorization).

Complete system Usable A Java team needs central RBAC and ABAC with row and field-level rules across several Spring services.

★ 106 MIT Java Active, pushed 2 days ago

Authzed-go authzed

Official SpiceDB client library for Go

Building block Production-ready You call SpiceDB from Go services.

★ 104 Apache-2.0 Go Active, pushed 39 days ago

Ruek uatuko

🔐 Lightning fast, global scale authorization service without the overhead of a yet another DSL.

Building block Experimental Only for experiments with a minimal, fast authorization service.

★ 101 Apache-2.0 C++ Slowing, pushed 9 months ago

Microsoft Entra ID Microsoft

Strengthen identity security with Microsoft Entra ID, a cloud identity and access (IAM) solution that prevents identity attacks and supports SSO and Zero Trust.

Complete system Production-ready Your organisation uses Microsoft 365 and wants identity and SSO without another vendor.

508 readers a month Since 2008 Commercial

Ping Identity Ping Identity

Ping Identity helps you protect your users and every digital interaction they have while making experiences frictionless.

Complete system Production-ready A large enterprise or bank has complex hybrid identity needs, including on-premise federation.

498 readers a month Since 2002 Commercial

JumpCloud JumpCloud

JumpCloud makes it simple to manage Windows, Apple, Linux, and Android devices and to deliver secure access with SSO, MFA, Zero Trust, RADIUS, and more.

Complete system Production-ready A small or midsize company without Active Directory wants one place for users, devices and access.

179 readers a month Commercial

Okta Workforce Identity Okta, Inc.

Okta Workforce Identity makes access for employees, contractors, and partners simple and secure. Discover how to reduce risk with Okta's scalable solution.

Complete system Production-ready A company with many SaaS apps wants vendor-neutral SSO and automated onboarding and offboarding.

Commercial

AWS IAM Identity Center Amazon Web Services

IAM Identity Center helps you securely create, or connect, your workforce identities and manage their access centrally across AWS accounts and applications.

Complete system Production-ready You run several AWS accounts and want engineers to sign in once with roles assigned centrally.

Commercial

Amazon Cognito Amazon Web Services

Implement customer identity and access management (CIAM) that scales to millions of users with Amazon Cognito, fully managed authentication service.

Building block Production-ready An application already on AWS needs cheap customer sign-in at scale.

Commercial

OneLogin One Identity

Cloud-based management provider

Complete system Production-ready A midsize company wants cheaper workforce SSO than Okta and the integrations it needs are supported.

126 readers a month Since 2009 Commercial

Google Cloud Identity Google

這個平台整合了身分識別資訊、存取權限、應用程式和端點管理 (IAM/EMM) 的功能。

Complete system Production-ready A Google Workspace or Google Cloud organisation wants to manage users and SSO without a separate identity vendor.

Commercial

Firebase Authentication Google

Descubre Firebase, la plataforma de Google para el desarrollo de apps web y para dispositivos móviles que ayuda a los desarrolladores a compilar apps y juegos que les fascinarán a los usuarios.

Building block Production-ready A mobile or web app built on Firebase needs simple sign-in quickly.

Commercial

Clerk Clerk

The easiest way to add authentication and user management to your application. Purpose-built for React, Next.js, Remix, and “The Modern Web”.

Building block Production-ready A React or Next.js team wants polished sign-in and user management working in an afternoon.

Commercial

WorkOS WorkOS

Developer APIs/SDKs for Enterprise Ready features like Single Sign-On, Directory Sync, Audit Logging, and more. Get started for free.

Building block Production-ready A B2B SaaS product needs to add SSO and SCIM for enterprise customers quickly.

Commercial

Stytch Stytch

APIs and SDKs to integrate authentication and security into your app.

Building block Production-ready A product team wants passwordless or passkey login with device fingerprinting against fraud.

Commercial

FusionAuth FusionAuth

FusionAuth provides complete auth software and user management solutions, with customizable tools like SSO, MFA, and integrations for OAuth2 and OpenID Connect.

Building block Production-ready You want an Auth0-style identity server you can run on your own infrastructure.

Commercial

Oso Cloud Oso Security

Oso helps companies run agents in production with confidence using monitoring, access controls, and automated least privilege.

Building block Usable Your app has outgrown hand-coded role checks and needs relationship- or attribute-based permissions.

Commercial

AuthZed Cloud AuthZed

Remove authorization bottlenecks, empower your team to innovate and expand with best-in-class performance at any scale.

Building block Production-ready A product needs Google Docs-style sharing permissions at scale and the team is ready to adopt a relationship model.

Commercial

Styra DAS Styra

Complete system Usable A platform team runs OPA in many places and wants central policy management and impact analysis.

Commercial