With over 14,000 GitHub stars, 1 million managed identities on Logto Cloud, and continuous releases through version 1.42.0 in July 2026, Logto has emerged as the most credible open-source alternative to Auth0, Clerk, and AWS Cognito by packaging OIDC, OAuth 2.1, enterprise SSO, multi-tenancy, and RBAC into a single MPL-2.0 codebase that self-hosts for free with no per-MAU pricing surprises. Every Logto tenant operates as a fully compliant OpenID Provider supporting PKCE-only public clients, DPoP token binding, and RFC 9068 JWT access tokens. Pre-built sign-in flows handle email, phone, social login via Google, Facebook, Azure AD, and dozens of connectors, passkey authentication, and multi-factor verification through TOTP and WebAuthn. Organizations enable first-class multi-tenancy where users belong to multiple tenants with per-organization RBAC scopes on API resources. Enterprise SSO connects to Okta, Entra ID, and any SAML or OIDC identity provider. SDKs for over 30 frameworks including React, Next.js, Angular, Vue, Flutter, Go, and Python integrate authentication into SPAs, web apps, mobile apps, APIs, machine-to-machine, and CLI tools. The admin console provides user management, audit logs, webhook event subscriptions, and custom domain configuration. Personal Access Tokens and token exchange support AI agent architectures and MCP server authentication. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MPL-2.0 licensed.

Securing a SaaS product, running B2B onboarding, or replacing Auth0 and Keycloak with a stack they own - teams needing more than basic auth reach for ZITADEL, an open-source identity and access management platform built in Go. Its multi-tenancy model is the differentiator: a strict Instance, Organization, Project hierarchy isolates data and scopes policy at each level, with identity brokering (pre-built templates for Google, GitHub, Microsoft, Apple, plus generic OIDC, OAuth, SAML, and LDAP), domain discovery that routes users to the right organization by email domain, and delegated management so customers administer their own users and roles. Authentication covers OpenID Connect (certified, including device authorization and token exchange), SAML 2.0 as both IdP and SP, SCIM, FIDO2 passkeys for phishing-resistant passwordless login, and MFA via OTP, email, SMS, and U2F; machine-to-machine flows support JWT profile, PATs, and client credentials. The architecture is event-sourced - every mutation is an immutable event, yielding a complete audit trail - with relational projections for queries and no external session store, so it scales horizontally. API-first with gRPC and REST, extensible via Actions webhooks, and the same codebase self-hosted (Docker Compose or Helm on PostgreSQL) as in the cloud.

With 13,800+ GitHub stars and active releases through 2026, Casdoor is the open-source identity platform that ships OAuth 2.0, OIDC, SAML 2.0, CAS, LDAP, SCIM 2.0, WebAuthn passkeys, TOTP multi-factor authentication, and Face ID biometric login in a single Go binary with a React web console — covering every authentication protocol your organization will ever need. Social login connects 50+ identity providers including Google, GitHub, Microsoft Azure AD, Facebook, WeChat, DingTalk, Apple, Twitter, and LinkedIn without custom code. The AI-first architecture includes a Model Context Protocol gateway for AI agent authentication and Agent-to-Agent protocol support for securing LLM-powered workflows. Built-in Casbin integration delivers authorization primitives beyond basic RBAC: attribute-based access control, relationship-based access control, and custom policy models through a unified engine. The organization-scoped multi-tenancy model isolates users, applications, and identity providers per tenant with customizable login pages, branding, and SMTP configuration. SCIM 2.0 endpoints automate user provisioning from HR systems and Active Directory. Official SDKs for Go, Java, Node.js, Python, and PHP accelerate application integration. The RESTful API exposes every resource for programmatic management. Comprehensive audit logs record authentication events and administrative actions. Deploy via Docker Compose with MySQL or PostgreSQL, the all-in-one SQLite Docker image for quick trials, or the official Kubernetes Helm chart for production clusters. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Powering authentication for over 15,000 GitHub stargazers and production deployments across startups and enterprises alike, SuperTokens delivers the complete login infrastructure that Auth0, Firebase Auth, and AWS Cognito charge premium prices for — entirely open source under Apache 2.0 with no per-user limits. The Java-based core service runs as a lightweight HTTP microservice that connects to PostgreSQL or MySQL and handles email-password login, passwordless magic links and OTP via email or SMS, social OAuth with Google, GitHub, Facebook, Apple, and any custom OIDC provider, phone-password authentication, and time-based one-time password multi-factor authentication. Session management uses rotating refresh tokens with anti-CSRF and anti-session-fixation protections, verifying tokens locally in your backend SDK without network round-trips to the core. Frontend SDKs for React, React Native, Angular, Vue, and vanilla JavaScript provide pre-built UI components for login, signup, email verification, and password reset flows, all customizable through an override system that lets you add pre- and post-API logic, custom hooks, and user event handlers. The built-in user management dashboard enables administrators to view users, reset passwords, revoke sessions, modify roles, and manage email verification status. Multi-tenancy and organization support powers B2B SaaS applications with tenant-level authentication configuration and Enterprise SSO via SAML and OIDC. Migration tools support bulk importing millions of existing password hashes, TOTP secrets, and role mappings. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Authentication that lives inside your application rather than behind a redirect to an external identity provider - SuperTokens takes a fundamentally different architecture from Auth0 and AWS Cognito. Three tiers make that work - frontend SDKs (React, Angular, Vue, vanilla JS, React Native) render overridable login UI and manage tokens; backend SDKs (Node.js, Python, Go) expose auth endpoints on your own API domain; and SuperTokens Core, the piece you host here, is the stateless HTTP service handling core auth logic, password hashing, token signing, and database operations against PostgreSQL. The recipe system keeps features decoupled: use email/password, social login, passwordless (magic links, OTP), phone-password, multi-factor authentication (TOTP, WebAuthn), user roles, and microservice auth - individually or combined; you can even use SuperTokens purely for session management alongside another login provider. Sessions are where it shines: rotating refresh tokens with theft detection, automatic access-token refresh, CSRF protection, and secure cookie handling out of the box - the details that become vulnerabilities when hand-rolled. Verification happens locally in your backend via cached JWT signing keys, so the Core stays off the hot path. Self-hosted means no user limits, free forever, with all user data in your database. Apache-licensed.

Your users belong in your own database - Authorizer, an open-source authentication and authorization server shipping as a single Go binary, keeps them there. It connects to 13+ backends - PostgreSQL, MySQL, SQLite, SQL Server, MariaDB, MongoDB, Cassandra, ScyllaDB, ArangoDB, DynamoDB, Couchbase, YugabyteDB, PlanetScale, and CockroachDB - so identity data lives beside the application it protects instead of in an auth vendor's cloud. The server is fully OAuth 2.0 and OpenID Connect compliant, including authorization code flow with PKCE, a JWKS endpoint, token revocation, and nine JWT signing algorithms. Login options cover email/password, magic links, TOTP multi-factor, SMS OTP via Twilio, and social providers including Google, GitHub, Apple, Microsoft, and Discord. Authorization goes beyond roles: an embedded OpenFGA engine provides Zanzibar-style relationship-based permission checks in process. APIs are exposed over GraphQL, REST, and gRPC, with SDKs for JavaScript, React, Go, and Python, plus themeable built-in login pages and an admin dashboard. Apache 2.0 licensed.

Backed by 9,000+ GitHub stars and developed by a Germany-based team with deep FIDO2 expertise, Hanko delivers the open-source authentication platform that replaces Auth0, Clerk, and Firebase Auth with a passkey-first architecture built on phishing-resistant WebAuthn credentials. The Go backend exposes both public and administrative HTTP APIs handling passkey registration and login, password authentication, email passcodes, TOTP-based MFA, security key verification, server-side sessions with remote revocation, and JWT issuing with configurable expiry and refresh policies. OAuth SSO connects Apple, Google, GitHub, Microsoft, and custom OIDC providers, while SAML Enterprise SSO integrates corporate identity providers for single sign-on across the organization. Hanko Elements provides framework-agnostic web components that embed complete onboarding, login, and user profile flows into any application with two lines of code, fully customizable via CSS variables and supporting i18n with custom translations. The JavaScript frontend SDK handles API communication, credential management, and session state for teams building custom authentication UIs without the pre-built components. Webhooks notify external services of authentication events including user creation, login, email verification, and password changes. Privacy-first design principles enforce data minimalism with user-deletable passwords and configurable identifier strategies supporting email-only, username-only, or combined approaches. Docker deployment starts the backend with PostgreSQL or MySQL, serving both APIs on configurable ports. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 (backend) / MIT (frontend) licensed.

Backed by over 8,700 GitHub stars and OpenID Connect certification, Pocket ID delivers what enterprise identity platforms like Keycloak provide but without the configuration complexity — a passkey-only OIDC provider purpose-built for homelabs and small deployments. The core design decision is radical simplicity: no passwords exist in the system, only WebAuthn-based passkeys using hardware security keys, TouchID, FaceID, or device PINs, making phishing attacks structurally impossible rather than merely discouraged. The Go backend built on the Gin framework serves a compiled SvelteKit frontend as static assets, running as a single Docker container with SQLite as the default database and optional PostgreSQL for larger deployments. User management supports manual creation, signup links, and open registration, with group-based access control that restricts which OIDC clients each group can access and attaches custom claims for downstream role mapping. LDAP synchronization pulls users and groups from OpenLDAP or Active Directory, while SCIM support enables automated provisioning from compatible identity sources. Federated client credentials handle machine-to-machine authentication for service-to-service communication patterns. The audit system logs every authentication event with GeoIP enrichment, sends email notifications for sign-ins from unknown devices, and provides one-time login codes for accessing accounts from devices without passkey support. TLS with HTTP/2 is built in, PKCE adds code exchange protection, and OpenTelemetry provides tracing and metrics integration. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD 2-Clause licensed.

One login for every internal tool, without handing your users another password to forget: Issuerd is a Keycloak-compatible identity provider that runs single sign-on for your whole stack from a single binary. Administrators manage realms, users, groups, clients, roles, client scopes, and protocol mappers in an embedded admin console, while end users get their own account console for passwords, passkeys, and two-factor settings. Authentication flows cover MFA, social login, and themable, localized login pages with per-realm language and email templates, so each audience sees a sign-in that looks like your product. Federation connects Samba AD, OpenLDAP, and Active Directory with user and group sync, password validation and write-through, plus Kerberos and SPNEGO for desktop single sign-on. For modern clients it implements DPoP token binding so stolen access tokens are useless without the holder's key, CIBA for approvals that happen on a second device, and token exchange patterns aimed at AI agents calling downstream services. Declarative YAML provisioning, a full management API, OpenAPI export, Prometheus metrics, and health probes round out day-two operations, and nodes scale horizontally behind any load balancer with no sticky sessions. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

With 13,800 GitHub stars, adoption by OpenAI for ChatGPT's authentication infrastructure serving 800 million weekly active users, and governance under the Ory open-source ecosystem, Ory Kratos provides enterprise-grade identity management as a headless API server that separates authentication logic from user interface — enabling any frontend framework to consume standardized self-service flows for registration, login, recovery, verification, and profile management. Multi-factor authentication supports passkeys, WebAuthn security keys, TOTP authenticator apps, SMS one-time codes, email magic links, and backup recovery codes with configurable Authenticator Assurance Levels enforcing step-up authentication for sensitive operations. Social sign-in connects to any OpenID Connect provider including Google, GitHub, Apple, and Microsoft, plus enterprise SAML 2.0 federation for B2B single sign-on. Customizable identity schemas using JSON Schema define user profiles with flexible trait structures, while pre- and post-flow webhooks enable integration with CRMs, analytics, and compliance systems. The courier system handles email and SMS delivery for verification codes and password recovery links. Session management provides device tracking, forced logout, and configurable lifespans with privileged session elevation. Deploy alongside Ory Hydra for OAuth2/OIDC token issuance and Ory Keto for fine-grained permissions to build a complete identity platform. Docker Compose deployment with PostgreSQL. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With over 24,000 GitHub stars and a rapidly growing community of self-hosters, authentik delivers enterprise-grade identity management that replaces commercial solutions like Okta and Auth0 with a fully self-hosted platform requiring no per-user licensing fees. The platform serves as a unified identity provider supporting SAML 2.0, OAuth 2.0 and OpenID Connect, LDAP for legacy application compatibility, SCIM 2.0 for automated user provisioning, and RADIUS for network device authentication. The visual flow designer enables administrators to create custom authentication workflows combining password verification, multi-factor authentication with TOTP, WebAuthn, and SMS codes, email verification, captcha challenges, and conditional logic based on user attributes or device context. The forward-auth and reverse proxy integration works seamlessly with Traefik, Nginx, Caddy, and Envoy to protect applications that lack built-in authentication. User enrollment flows support self-registration with configurable approval workflows, invitation links, and automatic group assignment. The LDAP outpost exposes user and group data to legacy applications requiring LDAP bind authentication, while the SCIM provider automates user lifecycle management with downstream applications. Multi-tenancy support through brands allows a single authentik instance to serve multiple organizations with independent domains, branding, and authentication policies. The admin interface provides comprehensive user management, group hierarchy, application catalog, event logging with GeoIP enrichment, and system health monitoring. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Licensed under a source-available license with an open-source community edition.

LLDAP is a lightweight user directory that lets all your self-hosted apps share one set of accounts and passwords. It speaks just enough LDAP for Nextcloud, Jellyfin, Gitea, GitLab, Grafana, Home Assistant, Proxmox VE, Vaultwarden, and many more to authenticate users against a single source of truth, with ready-made example configurations for more than 80 services. Day-to-day administration happens in a web interface where you create users, set passwords, upload avatars, build groups, and add members from a dropdown. Regular users can sign in to edit their own profile, and once SMTP is configured they can request a password-reset link by email instead of pinging the admin. Custom attributes (text, numbers, dates, or JPEG photos) are defined on the user and group schema pages, which unlocks integrations that expect fields such as uidNumber or homeDirectory, including Linux logins through PAM. Three built-in groups keep privileges tidy: lldap_admin for full control, lldap_password_manager for password resets, and lldap_strict_readonly for read-only service accounts. Group membership is exposed through memberOf filters, LDAPS secures connections when you expose the port, and a GraphQL API plus a bootstrap script let you manage users, groups, and attributes declaratively from JSON files. Pair it with Authelia, Authentik, or Keycloak when you also want single sign-on and multi-factor prompts. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Every service you self-host wants its own account database, and Kanidm exists so they can all share one: one identity server where people sign in with passkeys and every application trusts the same login. Users register YubiKeys, Touch ID, Windows Hello, or TPM backed authenticators, and attested passkey policies let administrators restrict sign-in to specific authenticator models in high security environments. Applications connect as OAuth2 or OpenID Connect clients with authorization code, client credentials, PKCE, token exchange, and revocation supported, so your wiki, Git forge, and file sync all delegate sign-in instead of storing passwords. The application portal gives each person one page of tiles for every service they may open, and role based access control decides which groups see which applications and scopes. Older systems that only speak LDAP bind to the read-only LDAPS gateway, while Wi-Fi and VPN gear authenticates through the built-in RADIUS server with MS-CHAPv2 and EAP-TLS. Linux machines join through the Unix client for PAM and NSS authentication, cached offline credentials protected by the machine TPM, and SSH keys distributed from the server to every host. A second server replicates the whole database with strong eventual consistency, every node accepting writes without elections or quorums, so a failed machine never locks your users out of sign-in. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MPL-2.0 licensed.

To protect self-hosted web services behind a unified single sign-on portal without deploying complex enterprise identity suites, Tinyauth acts as an OpenID Certified authentication server and reverse proxy middleware. Homelab operators and infrastructure teams place it in front of internal dashboards, media servers, and administrative tools routed through Traefik, Caddy, Nginx, Nginx Proxy Manager, or LinuxServer SWAG. Users can sign in with local bcrypt-hashed credentials, scan QR codes to enroll time-based one-time password authenticators for two-factor verification, or authenticate through external OAuth providers like GitHub, Google, and Pocket ID. Organizations running centralized directories can bind Tinyauth directly to an LDAP server such as LLDAP or OpenLDAP and automatically synchronize group memberships for role-based authorization. Fine-grained access control rules configured via dynamic Docker container labels or environment variables let administrators whitelist or block specific usernames, OAuth email regex patterns, OIDC groups, client IP CIDR ranges, and URL path prefixes per subdomain. For applications that support native federated login, the built-in OpenID Connect 1.0 discovery endpoint, authorization code flow, and userinfo API allow seamless single sign-on with optional consent skipping for trusted clients. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

OpenFGA answers the question 'can this user perform this action on this resource?' in single-digit milliseconds, implementing Google's Zanzibar paper as a production-ready authorization engine adopted by Auth0, Grafana Labs, Canonical, Docker, Agicap, and Read.AI. The server exposes both gRPC and HTTP APIs for authorization queries including Check, ListObjects, ListUsers, Expand, and the high-throughput BatchCheck endpoint that deduplicates and processes multiple authorization decisions in a single request. Authorization models combine relationship-based access control with role-based and attribute-based patterns through a purpose-built DSL that supports contextual tuples, conditional relationship tuples with CEL expressions, and time-based filtering via the ReadChanges API. Storage backends include PostgreSQL 14+, MySQL 8, and SQLite in beta, with an in-memory adapter for development and testing. Official SDKs for Java, .NET, Node.js, Go, and Python provide type-safe client integration, while a Terraform provider enables infrastructure-as-code management of authorization stores and models. The built-in browser playground at port 3000 lets developers visually model authorization schemas, write relationship tuples, and test access control queries interactively before deployment. OpenTelemetry instrumentation integrates with existing monitoring infrastructure, and Helm charts simplify Kubernetes deployment. A VS Code extension provides syntax highlighting and validation for FGA model files, and GitHub Actions automate model testing in CI/CD pipelines. A CNCF incubating project with transparent governance. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Cerbos decouples authorization logic from application code entirely, evaluating human-readable YAML policies in under one millisecond through a stateless Policy Decision Point that requires no application state synchronization or cross-network fan-out. Its custom decision engine benchmarks up to 17x faster than OPA-based alternatives. Access control policies use conditions expressed in Google's Common Expression Language, supporting role-based, attribute-based, and policy-based access control patterns including derived roles, scoped policies, and permissions-aware data filtering that pushes authorization predicates directly into database queries. The PDP exposes both gRPC and HTTP APIs with SDKs for JavaScript, Python, Go, Java, .NET, Rust, PHP, and Ruby, making integration a single function call regardless of tech stack. GitOps-native workflows treat policies as code with Git versioning, CI validation through GitHub Actions, coverage reports, breaking-change detection, and audit logs of every authorization decision for ISO27001, SOC2, and HIPAA compliance. Deployment flexibility spans Kubernetes sidecars, standalone services, systemd daemons, AWS Lambda functions, and WebAssembly-embedded PDPs that run authorization logic directly in browsers, serverless architectures, and edge devices. The Admin API manages policy lifecycle operations programmatically, while the built-in Playground and REPL provide interactive testing environments for policy authoring and debugging. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

'Can Maria edit this document?' is a simple question with a hard implementation, and SpiceDB is the open-source, Zanzibar-inspired database built to answer it and millions like it correctly. You model your product once in its schema language, defining object types like documents and organizations, relations like owner and member, and computed permissions built from unions, intersections, exclusions, and arrows through other objects. Your application then writes relationships as users join groups, create folders, and share files, and SpiceDB evaluates checks against that live graph in milliseconds. Check a single permission before rendering a button, check hundreds at once to filter a dashboard, look up every resource a user can open for search prefiltering, or list every subject who can access a file for an admin screen. Per-request consistency options, anchored by revision tokens, protect you from the classic race where a revoked user briefly keeps access, and caveats add conditional rules based on context like IP address or time. Relationships persist in PostgreSQL for simple deployments or CockroachDB and Spanner when you need multi-region scale, and the same schema files validate in CI with the command-line tool before they ever reach production. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.