Polis

Judgement

What it is

Building block

What it does

An SSO bridge, formerly BoxyHQ SAML Jackson, that lets your app accept enterprise SAML and OIDC logins through a simple OAuth flow and syncs users through SCIM directory sync.

Adopt it when

Enterprise customers ask your SaaS for SAML SSO and SCIM and you do not want to switch identity providers.

Watch out

Ownership moved from BoxyHQ to Ory, so watch how the roadmap and licensing evolve.

Ready for

Production-ready

Runs as

Self-hosted server and library

Built with

TypeScript, Next.js and PostgreSQL

How established

Established: started 5 years ago, latest release v26.2.0.

What the license allows

You can build it into a product you sell, as long as you keep its copyright notice.

Judged on 2026-11-03 from the project's README and GitHub data. The license and age lines are worked out directly.

Built from

Follow it down: Polis → TypeScript → Go → runs on a microchip

How compilers were built, back to punched paper tape

Open-source alternatives to Polis

1. 1
   Better Auth better-auth

   The most comprehensive authentication framework

   Building block Production-ready You are building a TypeScript web app and want auth in your own codebase and database instead of a hosted service.

   ★ 31k MIT TypeScript Active, pushed yesterday
2. 2
   Authelia authelia

   The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.

   Complete system Production-ready You self-host several web apps behind Nginx, Traefik or Caddy and want one login with MFA in front of them.

   ★ 29k Apache-2.0 Go Active, pushed today
3. 3
   Devise heartcombo

   Flexible authentication solution for Rails with Warden.

   Building block Production-ready You are building a Rails app with conventional email and password accounts.

   ★ 24k MIT Ruby Active, pushed 27 days ago
4. 4
   openGym DuarteSantos8

   Open-source gym & body-weight tracker, now in the App Store (iPhone + Apple Watch) and as an Android APK. Plan routines, log workouts, see which muscles are trained, import from Strong/Hevy/FitNotes. Self-host it or use it on the phone alone.

   Complete system Experimental You want a free workout log you can self-host or keep on your phone, without a subscription app.

   ★ 19k AGPL-3.0 JavaScript Active, pushed today
5. 5
   Casdoor casdoor

   An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD

   Complete system Production-ready You want a self-hosted SSO and user management server that is simpler to run than Keycloak.

   ★ 15k Apache-2.0 Go Active, pushed today
6. 6
   Django-allauth pennersr

   Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication. 🔁 Mirror of https://codeberg.org/allauth/django-allauth/

   Building block Production-ready You build a Django site that needs user accounts and social or SSO login.

   ★ 10k MIT Python Active, pushed 3 days ago
7. 7
   Hanko teamhanko

   Modern authentication, on your terms. Open source alternative to Auth0, Clerk, WorkOS, Stytch.

   Complete system Usable You want passkey-first login with drop-in UI components and the option to self-host.

   ★ 9.1k AGPL-3.0 Go Active, pushed today
8. 8
   Oauth2-server thephpleague

   A spec compliant, secure by default PHP OAuth 2.0 Server

   Building block Production-ready You need to issue OAuth tokens from a PHP application; Laravel Passport is built on it.

   ★ 6.7k MIT PHP Active, pushed 9 days ago

Commercial authentication libraries and frameworks

1. 1
   Amazon Cognito Amazon Web Services

   Implement customer identity and access management (CIAM) that scales to millions of users with Amazon Cognito, fully managed authentication service.

   Building block Production-ready An application already on AWS needs cheap customer sign-in at scale.

   Commercial
2. 2
   Firebase Authentication Google

   Descubre Firebase, la plataforma de Google para el desarrollo de apps web y para dispositivos móviles que ayuda a los desarrolladores a compilar apps y juegos que les fascinarán a los usuarios.

   Building block Production-ready A mobile or web app built on Firebase needs simple sign-in quickly.

   Commercial
3. 3
   Clerk Clerk

   The easiest way to add authentication and user management to your application. Purpose-built for React, Next.js, Remix, and “The Modern Web”.

   Building block Production-ready A React or Next.js team wants polished sign-in and user management working in an afternoon.

   Commercial
4. 4
   WorkOS WorkOS

   Developer APIs/SDKs for Enterprise Ready features like Single Sign-On, Directory Sync, Audit Logging, and more. Get started for free.

   Building block Production-ready A B2B SaaS product needs to add SSO and SCIM for enterprise customers quickly.

   Commercial
5. 5
   Stytch Stytch

   APIs and SDKs to integrate authentication and security into your app.

   Building block Production-ready A product team wants passwordless or passkey login with device fingerprinting against fraud.

   Commercial