Alternatives / WorkOS
Looking for an open source WorkOS alternative? We compared 11 open source authentication and authorization platforms by license, SSO, multi-tenancy, self-hosting, and pricing. They range from full identity providers to auth libraries and authorization engines, and several use licenses that are not standard open source.
Written by Maxime DERAME
Last updated:
| Alternative | Best for | License |
|---|---|---|
| Keycloak | Full identity provider with SAML and OIDC | Apache-2.0 |
| ZITADEL | Multi-tenant B2B identity | AGPL-3.0 with limited directory exceptions |
| authentik | Self-hosted identity provider | MIT core |
| Better Auth | TypeScript auth framework | MIT |
| Hanko | Passkey-first authentication | AGPL-3.0 |
| SuperTokens | Flexible, language-agnostic auth | Apache-2.0 core / Enterprise components |
| Ory | Modular enterprise identity | Apache-2.0 core |
| Hexclave | Auth plus payments and email | MIT clients / AGPL-3.0 servers |
| Authgear | B2C and B2B apps with biometrics | Apache-2.0 |
| Permify | Authorization only: RBAC, ABAC, ReBAC | AGPL-3.0 |
| Cerbos | Policy-based authorization only | Apache-2.0 core |
We looked for open-source tools that overlap with WorkOS's core: letting a B2B app offer enterprise SSO, directory sync, and organization-level access. We verified each project's license, recent activity, stars, and self-hosting in its repository. WorkOS is a hosted API, so we separate full identity providers from libraries and authorization-only engines, and flag open-core licenses. See our methodology for the full criteria.
Permify and Cerbos handle authorization, meaning who can do what, not authentication or SSO. They complement an identity provider rather than replace WorkOS on their own. Better Auth is a TypeScript framework, so it is aimed at TypeScript applications.
Keycloak, Zitadel, and Authentik are the closest, as full identity providers with SSO, SAML, OIDC, MFA, and multi-tenancy. Keycloak is powerful but complex to configure, Zitadel is available as a managed service or self-hosted with strong multi-tenant support, and Authentik deploys with Kubernetes, Terraform, or Docker Compose.
Keycloak is Apache-2.0 and Better Auth is MIT. Zitadel is AGPL-3.0 with limited directory exceptions, and Permify is AGPL-3.0. Ory's core is Apache-2.0, with enterprise features under commercial agreements, SuperTokens is Apache-2.0 with enterprise code under ee, and Cerbos is Apache-2.0 at its core. Authentik is MIT with an enterprise directory, Hanko is AGPL-3.0 with a separately licensed elements directory, Hexclave is MIT for clients and AGPL-3.0 for servers, and Authgear is Apache-2.0.
All eleven projects had commits within days or weeks of this update. Ory's last commit was in July 2026.
WorkOS is a proprietary hosted service priced per connection for enterprise SSO and directory sync, so each enterprise customer you onboard adds cost, and identity data is stored on its platform. Open-source alternatives let you self-host identity, avoid per-connection pricing, and keep user data under your control, at the cost of running and securing the identity layer yourself.
Apache-2.0 IAM platform providing SSO, social login, LDAP and Active Directory federation, OpenID Connect, OAuth 2.0, SAML, MFA, user management, authorization policies, and customizable authentication flows.
Pricing: Free and open source; self-hosted or operated through third-party services.
MIT authentication and authorization framework that runs inside a TypeScript application rather than as a standalone identity service. Supports email/password, social login, two-factor authentication, organizations, sessions, and an extensible plugin ecosystem.
Pricing: Open-source framework; you operate the application and its infrastructure.
Identity provider with an MIT-licensed core and a separate Enterprise offering. Supports OAuth2/OIDC, SAML, LDAP, RADIUS, SCIM, proxy authentication, MFA, conditional flows, and application access management.
Pricing: Self-hosted open-source core; Enterprise features and support are commercial.
Open-core authentication platform with Apache-2.0 core and separately licensed Enterprise code under ee/. Supports password and passwordless login, social sign-in, sessions, user management, access control, multi-tenancy, and backend and frontend SDKs.
Pricing: Self-hosted open-source core and managed cloud; Enterprise components are separately licensed.
AGPL-3.0 identity platform with limited directory exceptions, providing OIDC, OAuth2, SAML, SCIM, MFA, passkeys, organizations, multi-tenancy, audit logs, roles, APIs, managed cloud, and self-hosting.
Pricing: Managed cloud and self-hosted deployment options.
Apache-2.0 core identity stack including Kratos for identity and authentication, Hydra for OAuth2/OIDC, and Keto for authorization. Provides headless APIs, passkeys, social login, MFA, cloud-native deployment, Kubernetes support, and self-hosting; some enterprise features use commercial agreements.
Pricing: Self-hosted open-source components and managed services; enterprise features are commercial.
AGPL-3.0 authentication platform for passwords and passwordless login, email passcodes, social sign-in, SSO, MFA, WebAuthn passkeys, web components, and self-service profiles. Available as self-hosted software or Hanko Cloud.
Pricing: Open-source self-hosted option and managed cloud service.
Open-source-codebase self-hostable platform combining authentication and authorization with teams, multi-tenancy, payments, billing, transactional email, analytics, passkeys, and API keys. Broader than a conventional identity provider.
Pricing: Open source and self-hostable; enterprise licenses and a hosted service are available.
AGPL-3.0 self-hosted authorization service for RBAC, ABAC, and relationship-based access control. It evaluates what authenticated users may do; it does not provide Auth0-style authentication or user login.
Pricing: Open-source self-hosted service; hosted offerings may be separate.
Apache-2.0 core authorization engine that evaluates policies through local or remote decision points. Supports RBAC, ABAC, YAML policies, GitOps workflows, language-agnostic SDKs, and self-hosting; enterprise management features are separate.
Pricing: Open-source self-hosted engine; enterprise management features are separate.
Apache-2.0 authentication and IAM server with passwords, passwordless and social login, MFA, biometrics, passkeys, SSO, user management, and authorization. Can be self-hosted or used through Oursky's managed service.
Pricing: Self-hosted server and managed service options.
| Alternative | Type | License | Self-hosted | Best for |
|---|---|---|---|---|
| Hanko | Passkey-first auth | AGPL-3.0 (elements directory separate) | Yes | Passkeys |
| Keycloak | Identity provider | Apache-2.0 | Yes | SSO and federation |
| Better Auth | Auth framework | MIT | Library | TypeScript apps |
| authentik | Identity provider | MIT core + enterprise | Yes | Self-hosted SSO |
| ZITADEL | Identity platform | AGPL-3.0 | Yes | Multi-tenant B2B |
| SuperTokens | Auth platform | Apache-2.0 + ee | Yes | Flexible auth |
| Ory | Identity infrastructure | Apache-2.0 core | Yes | Modular identity |
| Hexclave | User infrastructure | MIT / AGPL-3.0 | Yes | Auth plus payments |
| Permify | Authorization | AGPL-3.0 | Yes | RBAC, ABAC, ReBAC |
| Cerbos | Authorization | Apache-2.0 core | Yes | Policy-based access |
| Authgear | Identity platform | Apache-2.0 | Yes | B2C and B2B apps |
Want a full identity provider with SAML and OIDC
Keycloak offers SSO, social login, and fine-grained authorization under Apache-2.0, but it is complex to configure.
Want multi-tenant B2B identity
Zitadel offers hosted login, SSO, MFA, RBAC, and multi-tenant support, as a managed service or self-hosted.
Building a TypeScript app
Better Auth is an MIT TypeScript framework with email and password, social sign-on, 2FA, and multi-tenant support.
Want passkey-first login
Hanko is passkey-first with 2FA, SSO, and social login, with legacy password support for gradual migration.
Need fine-grained authorization
Permify is an authorization service supporting RBAC, ABAC, and ReBAC, but it does not do authentication.