Alternatives / Clerk

9 Best Open Source Clerk Alternatives in 2026

Looking for an open source Clerk alternative? We compared 9 open source authentication and identity platforms by license, self-hosting, passkeys, SSO, multi-tenancy, and pricing. They range from TypeScript auth libraries to full identity providers.

Written by Maxime DERAME

Last updated: October 3, 2026

Best Clerk alternatives at a glance

Alternative	Best for	License
Better Auth	TypeScript auth library with plugins	MIT
authentik	Self-hosted identity provider	MIT core
ZITADEL	Multi-tenant B2B identity	AGPL-3.0 with limited directory exceptions
Logto	Customizable login experiences	MPL-2.0
SuperTokens	Flexible, language-agnostic auth	Apache-2.0 core / Enterprise components
Ory	Modular enterprise identity	Apache-2.0 core
Hanko	Passkey-first authentication	AGPL-3.0
Hexclave	Auth plus payments and email	MIT clients / AGPL-3.0 servers
Authgear	B2C and B2B apps with biometrics	Apache-2.0

How we chose these Clerk alternatives

We looked for open-source projects that overlap with Clerk's core: sign-up and sign-in, sessions, social login, MFA and passkeys, and user management for your app. We verified each project's license, recent activity, stars, and self-hosting in its repository. Clerk is a hosted, drop-in component service, so the list mixes auth libraries, identity providers, and full platforms, and we flag open-core licenses. See our methodology for the full criteria.

Important: libraries, identity providers, and platforms differ

Better Auth and SuperTokens are libraries or services you integrate into your app's backend. Hanko and Logto focus on login experiences with passkeys and customizable flows. Authentik, Zitadel, and Ory are full identity providers with SSO protocols such as OIDC and SAML. Hexclave is broader, adding teams, payments, email, and analytics, and Authgear is a full IAM server with a managed service.

Closest to Clerk

Better Auth and Hanko are the closest for developers: drop-in or framework-integrated auth with passkeys, social login, MFA, and multi-tenant support in TypeScript projects. Logto and SuperTokens offer pre-built login UIs and flexible APIs, while Hexclave goes furthest toward a Clerk-like all-in-one product.

License details

Better Auth is MIT, Logto is MPL-2.0, and Authgear and Ory's core are Apache-2.0. Authentik is MIT with an enterprise directory under a separate license. Hanko, Zitadel, and Hexclave's servers are AGPL-3.0, with Hexclave's clients under MIT. SuperTokens is Apache-2.0 for its core, with enterprise components under a separate license.

Self-hosting

All nine can be self-hosted, and most also offer managed cloud services. Authgear can be self-hosted despite also being a managed IAM product, Ory is available as self-hosted open source or managed cloud, and Authentik runs on Docker Compose, Kubernetes, or Terraform.

Maintenance status

All nine projects were updated within weeks of this update. Ory's repositories were last updated in July 2026, so check its release cadence if you rely on it heavily.

Why look for a Clerk alternative?

Clerk is a proprietary hosted authentication service priced per monthly active user, with user data stored on its platform and a tight link to its frontend components. Open-source alternatives let you self-host or embed auth in your own stack, keep user data, avoid per-user pricing, and avoid vendor lock-in, at the cost of setup and maintenance and, for some, fewer pre-built UI components.

Better Auth

TypeScript-first authentication framework for applications

MIT authentication and authorization framework that runs inside a TypeScript application rather than as a standalone identity service. Supports email/password, social login, two-factor authentication, organizations, sessions, and an extensible plugin ecosystem.

30.2K2.9KMITIntegrated in application

Pricing: Open-source framework; you operate the application and its infrastructure.

MIT license and TypeScript-first design
Framework-agnostic with email/password, social login, and 2FA
Organizations, sessions, plugins, and type-safe API without a separate identity server
Not a managed Auth0-style service by itself
Authentication responsibilities remain in your application
Enterprise federation may require additional setup

View on GitHub

authentik

Self-hosted identity provider for SSO and enterprise IAM

Identity provider with an MIT-licensed core and a separate Enterprise offering. Supports OAuth2/OIDC, SAML, LDAP, RADIUS, SCIM, proxy authentication, MFA, conditional flows, and application access management.

25.8K2.1KMIT coreSelf-hosted

Pricing: Self-hosted open-source core; Enterprise features and support are commercial.

OIDC, OAuth2, SAML, LDAP, RADIUS, and SCIM
MFA, proxy provider, and custom authentication flows
Docker and Kubernetes support with broad homelab and enterprise adoption
More infrastructure than an in-app authentication library
Enterprise functionality exists separately
Configuration can become complex

View on GitHub

SuperTokens

Developer-oriented authentication platform and SDKs

Open-core authentication platform with Apache-2.0 core and separately licensed Enterprise code under ee/. Supports password and passwordless login, social sign-in, sessions, user management, access control, multi-tenancy, and backend and frontend SDKs.

15.3K841Apache-2.0 core / Enterprise componentsSelf-hosted

Pricing: Self-hosted open-source core and managed cloud; Enterprise components are separately licensed.

Apache-2.0 core with self-hosting and managed cloud
Password, passwordless, and social authentication with session management
Multi-tenancy and developer-friendly frontend/backend SDKs
Enterprise components use separate licensing
Less complete workforce IAM than Keycloak
SAML and enterprise federation are not central to the open-source core

View on GitHub

ZITADEL

Identity infrastructure for SaaS and B2B applications

AGPL-3.0 identity platform with limited directory exceptions, providing OIDC, OAuth2, SAML, SCIM, MFA, passkeys, organizations, multi-tenancy, audit logs, roles, APIs, managed cloud, and self-hosting.

15.2K1.3KAGPL-3.0 with limited directory exceptionsSelf-hosted

Pricing: Managed cloud and self-hosted deployment options.

OIDC, OAuth2, SAML, and SCIM
Passkeys, MFA, organizations, multi-tenancy, and audit logs
API-first B2B SaaS fit with hosted cloud and self-hosting
More complex than lightweight authentication libraries
AGPL terms require consideration for modified network deployments
Smaller integration ecosystem than Auth0

View on GitHub

Logto

OIDC and OAuth 2.1 authentication and authorization platform

MPL-2.0 platform with login flows, social authentication, MFA, organizations, SSO, RBAC, machine-to-machine authentication, connectors, and SDKs for many frameworks. Supports self-hosting and hosted service.

14.7K1.2KMPL-2.0Self-hosted

Pricing: Self-hosted open-source edition and hosted cloud service; some advanced services are cloud-oriented.

OIDC and OAuth 2.1
Password and passwordless login, social auth, MFA, organizations, and SSO
RBAC, machine-to-machine auth, connectors, and 30+ framework SDKs
Younger than Keycloak
Smaller enterprise ecosystem
Some advanced services are cloud-oriented

View on GitHub

Ory

Modular open-source identity and access infrastructure

Apache-2.0 core identity stack including Kratos for identity and authentication, Hydra for OAuth2/OIDC, and Keto for authorization. Provides headless APIs, passkeys, social login, MFA, cloud-native deployment, Kubernetes support, and self-hosting; some enterprise features use commercial agreements.

13.9K1.2KApache-2.0 coreSelf-hosted

Pricing: Self-hosted open-source components and managed services; enterprise features are commercial.

Modular components for authentication, OAuth/OIDC, and authorization
Apache-2.0 core with passkeys, social login, MFA, and headless APIs
Cloud-native and Kubernetes-friendly with self-hosting
Requires more architecture decisions
Multiple components may be needed
Enterprise functionality is separately licensed and less turnkey than Auth0

View on GitHub

Hanko

Authentication platform built around passkeys

AGPL-3.0 authentication platform for passwords and passwordless login, email passcodes, social sign-in, SSO, MFA, WebAuthn passkeys, web components, and self-service profiles. Available as self-hosted software or Hanko Cloud.

9K1KAGPL-3.0Self-hosted

Pricing: Open-source self-hosted option and managed cloud service.

Passkeys are a first-class feature alongside passwords
Email passcodes, social login, SSO, and MFA
Web components, self-service profiles, self-hosting, and cloud option
Smaller ecosystem than Keycloak
Less extensive enterprise federation
More focused on authentication than workforce IAM

View on GitHub

Hexclave

Self-hostable user infrastructure for SaaS products

Open-source-codebase self-hostable platform combining authentication and authorization with teams, multi-tenancy, payments, billing, transactional email, analytics, passkeys, and API keys. Broader than a conventional identity provider.

6.9K523MIT clients / AGPL-3.0 serversSelf-hosted

Pricing: Open source and self-hostable; enterprise licenses and a hosted service are available.

Authentication, authorization, teams, and multi-tenancy
Payments, billing, email, analytics, passkeys, and API keys
Designed as broader infrastructure for SaaS applications
Much broader than Auth0
Younger project with smaller ecosystem
Extra modules may be unnecessary for teams needing only authentication

View on GitHub

Authgear

Open-source identity and access management for B2B and B2C

Apache-2.0 authentication and IAM server with passwords, passwordless and social login, MFA, biometrics, passkeys, SSO, user management, and authorization. Can be self-hosted or used through Oursky's managed service.

2.1K128Apache-2.0Self-hosted

Pricing: Self-hosted server and managed service options.

Apache-2.0 with password and passwordless sign-in
Social login, MFA, biometrics, passkeys, and SSO
B2B and B2C user management, authorization, and self-hosting
Much smaller community and fewer integrations than Auth0
Managed-product documentation is more prominent
Smaller ecosystem than Keycloak or ZITADEL

View on GitHub

Compare Clerk alternatives

Alternative	Type	License	Self-hosted	Best for
Hanko	Auth platform	AGPL-3.0	Yes	Passkeys
Better Auth	Auth framework	MIT	Yes	TypeScript apps
authentik	Identity provider	MIT core + enterprise	Yes	Self-hosted SSO
ZITADEL	Identity platform	AGPL-3.0	Yes	B2B multi-tenancy
Logto	Identity solution	MPL-2.0	Yes	Custom login flows
SuperTokens	Auth solution	Apache-2.0 core	Yes	Language-agnostic auth
Ory	Identity infrastructure	Apache-2.0 core	Yes	Enterprise flexibility
Hexclave	Auth and product platform	MIT clients / AGPL-3.0 servers	Yes	Unified infrastructure
Authgear	IAM platform	Apache-2.0	Yes	B2C and B2B apps

Which one should you choose?

Want a TypeScript auth library with plugins

Better Auth offers email and password, social sign-on, 2FA, multi-tenant support, and a plugin ecosystem across React, Vue, Svelte, Next.js, and Nuxt.

Better Auth

Want passkey-first authentication

Hanko supports passkeys, email passcodes, social login, SSO, and MFA with drop-in web components.

Hanko

Need a self-hosted identity provider

Authentik offers SSO with SAML, OAuth2, OIDC, LDAP, and RADIUS, plus customizable flows and MFA.

authentik

Build multi-tenant B2B apps

Zitadel offers multi-tenancy, organizations, SSO, role-based access control, and modern APIs.

ZITADEL

Want fully customizable login screens

Logto offers customizable login experiences, multi-tenancy, and connectors under MPL-2.0.

Logto

Want an all-in-one auth and product backend

Hexclave combines authentication with teams, payments, transactional email, and analytics as modular building blocks.

Hexclave

Need enterprise-grade modular identity

Ory offers modular open-source identity components with managed cloud options for scaling enterprises.

Ory

← Browse more software