Authentication libraries and frameworks in 2026

Commercial authentication libraries and frameworks

1. 1
   Amazon Cognito Amazon Web Services

   Implement customer identity and access management (CIAM) that scales to millions of users with Amazon Cognito, fully managed authentication service.

   Building block Production-ready An application already on AWS needs cheap customer sign-in at scale.

   Commercial
2. 2
   Firebase Authentication Google

   Descubre Firebase, la plataforma de Google para el desarrollo de apps web y para dispositivos móviles que ayuda a los desarrolladores a compilar apps y juegos que les fascinarán a los usuarios.

   Building block Production-ready A mobile or web app built on Firebase needs simple sign-in quickly.

   Commercial
3. 3
   Clerk Clerk

   The easiest way to add authentication and user management to your application. Purpose-built for React, Next.js, Remix, and “The Modern Web”.

   Building block Production-ready A React or Next.js team wants polished sign-in and user management working in an afternoon.

   Commercial
4. 4
   WorkOS WorkOS

   Developer APIs/SDKs for Enterprise Ready features like Single Sign-On, Directory Sync, Audit Logging, and more. Get started for free.

   Building block Production-ready A B2B SaaS product needs to add SSO and SCIM for enterprise customers quickly.

   Commercial
5. 5
   Stytch Stytch

   APIs and SDKs to integrate authentication and security into your app.

   Building block Production-ready A product team wants passwordless or passkey login with device fingerprinting against fraud.

   Commercial

New open-source projects

1. 1
   openGym DuarteSantos8

   Open-source gym & body-weight tracker, now in the App Store (iPhone + Apple Watch) and as an Android APK. Plan routines, log workouts, see which muscles are trained, import from Strong/Hevy/FitNotes. Self-host it or use it on the phone alone.

   Complete system Experimental You want a free workout log you can self-host or keep on your phone, without a subscription app.

   ★ 19k AGPL-3.0 JavaScript Active, pushed today

Open-source authentication libraries and frameworks

Complete systems you can adopt 4

1. 1
   Authelia authelia

   The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.

   Complete system Production-ready You self-host several web apps behind Nginx, Traefik or Caddy and want one login with MFA in front of them.

   ★ 29k Apache-2.0 Go Active, pushed today
2. 2
   openGym DuarteSantos8

   Open-source gym & body-weight tracker, now in the App Store (iPhone + Apple Watch) and as an Android APK. Plan routines, log workouts, see which muscles are trained, import from Strong/Hevy/FitNotes. Self-host it or use it on the phone alone.

   Complete system Experimental You want a free workout log you can self-host or keep on your phone, without a subscription app.

   ★ 19k AGPL-3.0 JavaScript Active, pushed today
3. 3
   Casdoor casdoor

   An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD

   Complete system Production-ready You want a self-hosted SSO and user management server that is simpler to run than Keycloak.

   ★ 15k Apache-2.0 Go Active, pushed today
4. 4
   Hanko teamhanko

   Modern authentication, on your terms. Open source alternative to Auth0, Clerk, WorkOS, Stytch.

   Complete system Usable You want passkey-first login with drop-in UI components and the option to self-host.

   ★ 9.1k AGPL-3.0 Go Active, pushed today

Building blocks for your own system 6

1. 1
   Better Auth better-auth

   The most comprehensive authentication framework

   Building block Production-ready You are building a TypeScript web app and want auth in your own codebase and database instead of a hosted service.

   ★ 31k MIT TypeScript Active, pushed yesterday
2. 2
   Devise heartcombo

   Flexible authentication solution for Rails with Warden.

   Building block Production-ready You are building a Rails app with conventional email and password accounts.

   ★ 24k MIT Ruby Active, pushed 27 days ago
3. 3
   Django-allauth pennersr

   Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication. 🔁 Mirror of https://codeberg.org/allauth/django-allauth/

   Building block Production-ready You build a Django site that needs user accounts and social or SSO login.

   ★ 10k MIT Python Active, pushed 3 days ago
4. 4
   Oauth2-server thephpleague

   A spec compliant, secure by default PHP OAuth 2.0 Server

   Building block Production-ready You need to issue OAuth tokens from a PHP application; Laravel Passport is built on it.

   ★ 6.7k MIT PHP Active, pushed 9 days ago
5. 5
   Next-auth nextauthjs

   Authentication for the Web.

   Building block Production-ready You maintain an existing Next.js app on NextAuth or need stateless sessions without a database.

   ★ 28k ISC TypeScript Slowing, pushed 3 months ago
6. 6
   Doorkeeper doorkeeper-gem

   Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape.

   Building block Production-ready Your Rails app needs to offer an OAuth API to third-party or mobile clients.

   ★ 5.5k MIT Ruby Active, pushed today

All 30 open-source authentication library projects

Also under identity providers and single sign-on servers

Open-source licenses

• Permissive: 25. Use it anywhere, including in closed products. You keep the copyright notice; Apache-2.0 also grants patent rights.
• Network copyleft: 3. Like GPL, and running a changed version as a web service counts as distributing it, so its users get the source too.
• Weak copyleft: 2. Changes to the licensed files must be shared, but you can link them into a closed program.

Languages

Go 7, Python 6, Rust 5, TypeScript 4, Ruby 3, JavaScript 2, C# 2 and PHP 1.