Alternatives / Auth0
These projects cover different layers of identity: turnkey identity providers, authentication frameworks, modular identity components, and authorization engines. Some are close Auth0 replacements; Permify and Cerbos handle permissions after authentication rather than user login.
Written by Maxime DERAME
Last updated:
Authentication answers who a user is: passwords, passkeys, social login, MFA, OAuth, and SSO. Authorization answers what that user may do, such as edit a document or invite organization members. Auth0 covers both layers to some extent. Hanko, Keycloak, ZITADEL, Logto, SuperTokens, Authgear, and Better Auth primarily handle authentication and identity; Permify and Cerbos focus on authorization and must be combined with an identity provider.
Keycloak, authentik, ZITADEL, Logto, and Authgear operate as identity services that applications connect to through protocols such as OIDC and SAML. Better Auth runs inside a TypeScript application and uses infrastructure the application controls. This avoids a separate identity server but puts more authentication responsibility inside the application stack.
Hanko supports passkeys alongside passwords, email codes, MFA, and social authentication. Pocket ID intentionally makes passkeys the only user authentication method, making it a lightweight fit for small self-hosted environments that want to avoid passwords.
For workforce SSO, compare support for SAML, OIDC, SCIM, LDAP, Active Directory, organizations, and multi-tenancy. Keycloak and authentik are strong for workforce and enterprise federation. ZITADEL and Logto are attractive for modern B2B SaaS applications.
Check the exact license and feature boundaries before choosing. authentik has an MIT-licensed core alongside Enterprise functionality; SuperTokens has Apache-2.0 core with separately licensed ee components; Ory's Apache-2.0 core coexists with commercial enterprise features. ZITADEL uses AGPL-3.0 with limited directory exceptions, while the other projects have their own stated licenses and terms.
Teams consider Auth0 alternatives for self-hosting, predictable infrastructure costs, control over user data, avoiding monthly active user pricing, and support for OIDC, OAuth, SAML, passkeys, MFA, social login, organizations, SCIM, and fine-grained permissions. Auth0 bundles these into a managed platform; open-source projects range from full IAM systems to in-app frameworks and individual components.
| Alternative | Type | License | Status | GitHub stars | Self-hosted |
|---|---|---|---|---|---|
| Hanko | Authentication | AGPL-3.0 | Open source | ~9k | Yes |
| Keycloak | IAM | Apache-2.0 | Open source | ~37k | Yes |
| Better Auth | Auth framework | MIT | Open source | ~30.1k | In-app |
| authentik | IdP / IAM | MIT core | Open source / commercial | ~25.7k | Yes |
| ZITADEL | IAM | AGPL-3.0 | Open source | ~15.1k | Yes |
| Logto | Auth + authorization | MPL-2.0 | Open source | ~14.6k | Yes |
| SuperTokens | Authentication | Apache-2.0 core | Open core | ~15.3k | Yes |
| Ory | Identity infrastructure | Apache-2.0 core | Open source / open core | ~13.9k Kratos | Yes |
| Pocket ID | Lightweight IdP | BSD-2-Clause | Open source | ~9.2k | Yes |
| Hexclave | User infrastructure | Open-source codebase | Open source | ~6.8k | Yes |
| Permify | Authorization | AGPL-3.0 | Open source | ~6k | Yes |
| Cerbos | Authorization | Apache-2.0 | Open core | ~4.6k | Yes |
| Authgear | IAM | Apache-2.0 | Open source / managed | ~2k | Yes |
Want the most mature open-source IAM
Keycloak has a long enterprise track record and supports OIDC, SAML, LDAP, Active Directory, social identity providers, MFA, custom flows, and authorization.
Want a modern Auth0-style identity platform
ZITADEL combines developer APIs, OIDC, OAuth, SAML, SCIM, MFA, passkeys, organizations, multi-tenancy, audit logs, cloud, and self-hosting.
Want authentication inside a TypeScript app
Better Auth runs within the application stack and provides TypeScript-first authentication without a separate identity server.
Want a passkey-focused authentication platform
Hanko makes passkeys a first-class feature while also supporting passwords, email codes, MFA, SSO, social login, and self-hosting.
Want a lightweight passkey-only OIDC provider
Pocket ID deliberately keeps its scope small and uses passkeys as the user authentication method for self-hosted OIDC applications.
Need SSO for internal applications
authentik supports OIDC, OAuth, SAML, LDAP, RADIUS, SCIM, proxy authentication, MFA, and custom flows; Keycloak is another mature option.
Want developer-focused authentication SDKs
SuperTokens offers authentication recipes, session management, multi-tenancy, and backend and frontend SDKs, with separately licensed Enterprise components.
Want modular identity infrastructure
Ory separates identity and authentication, OAuth/OIDC, and authorization into components such as Kratos, Hydra, and Keto.
Need authorization without user authentication
Permify provides RBAC, ABAC, and relationship-based authorization and should be paired with an identity provider.
Want policy-as-code authorization
Cerbos externalizes application permissions into policies and decision points, but does not provide user login or authentication.
Need authentication for B2B and B2C applications
Authgear combines passwords, social and passwordless login, MFA, biometrics, passkeys, SSO, user management, and authorization.
Want authentication plus broader SaaS infrastructure
Hexclave combines identity with teams, permissions, payments, billing, email, analytics, and other product infrastructure.
Want a permissive license for an in-app framework
Better Auth uses MIT; Keycloak and Authgear use Apache-2.0, Pocket ID uses BSD-2-Clause, and Logto uses MPL-2.0.