Auth

keycloak36.8k★

Keycloak is the default answer to "we need SSO but we're not paying Okta." It handles logins, SAML, OIDC, MFA, and user federation with LDAP and Active Directory for every app you own. Red Hat has backed it for over a decade, it's now a CNCF project, and every feature ships free under Apache 2.0. There is no paid edition hiding the good parts. Running it is the tradeoff. It's a Java server that wants real memory, and clustering, database setup, and version upgrades take actual attention. The realm and client configuration model is powerful and famously confusing on first contact. Plan on Keycloak being a system you own, not a container you forget. Solo and homelab: goauthentik/authentik is friendlier for the same job. Small teams: Keycloak works, budget real setup time. Enterprises: this is the one. It handles thousands of users, weird federation requirements, and compliance checkboxes that paid identity providers charge five figures a year for. The catch: nobody sells you a managed Keycloak with an SLA except Red Hat, through their commercial build. Self-hosting an identity provider means every login in your company depends on infrastructure you keep alive.

Authelia29.0k★

Authelia is the bouncer that sits in front of everything you self-host. It plugs into your reverse proxy, Traefik, Caddy, nginx or Envoy, and forces a login with single sign-on and two-factor before a request reaches the app behind it. Apache 2.0, written in Go, donation funded, no paid tier. Setup is config-file driven, and the learning curve is mostly wiring the forward-auth integration correctly. Second factor covers WebAuthn hardware keys, TOTP apps and Duo push, with passkeys for passwordless. Access rules match on subdomain, user, group, path, method and network. Redis and a real database get you high availability. It is a full OpenID Connect provider too, certified against five profiles, so it issues tokens to other apps rather than only gating them. The project still labels that beta. SAML is absent entirely. If you need it, or a user-management UI, or a directory of your own, Authentik and Keycloak do more for more complexity. The catch is in their own README. The project is actively seeking sponsorship to fund a code security audit and penetration testing, which means it has not had one. For software whose whole job is standing between the internet and your services, sit with that before deploying.

Authentik25.6k★

SSO (single sign-on), multi-factor auth, user directories, all in one place. The open source version is extremely capable. You get SAML, OAuth2/OIDC, LDAP, SCIM, and proxy authentication. The admin UI is clean and modern. You can set up enrollment flows, password recovery, and MFA without touching code. For a homelab or small company, this replaces paid services like Okta or Auth0. Authentik Enterprise adds features like long-term support, AI-powered risk assessment, and enterprise support starting at $5/user/mo with a 100-user minimum ($500/mo floor). Solo/homelab: the open source version is fantastic. Small teams: same. Growing teams needing vendor support: Enterprise makes sense at $5/user/mo. Large orgs: serious Okta alternative at a fraction of the cost. The catch: initial setup has a learning curve. Authentik uses a flow-based system for authentication logic that's powerful but not intuitive at first. Plan to spend a weekend getting it right. Docker Compose is the recommended deployment; you'll run Postgres, Redis, and the Authentik containers.

Passport23.5k★

Passport is the authentication middleware for Node.js that supports 500+ strategies. It plugs into Express (or any Connect-compatible framework) and gives you a strategy-based system where each login method is a plugin. MIT, JavaScript. The architecture is simple: pick a strategy (passport-local for email/password, passport-google-oauth20 for Google), configure it, add two routes (login and callback), done. There are 500+ community strategies covering everything from Twitter to LDAP to TOTP. Fully free. No paid tier, no hosted service. Every strategy is open source. Solo to large teams: free across the board. Passport is the most battle-tested auth library in the Node ecosystem. If you're on Express, it's probably already in your dependencies. The catch: Passport is showing its age. The core hasn't had a major update in years. Session-based authentication is the default pattern, and while you can do JWT and stateless auth, it's not native. Modern alternatives like Lucia or Auth.js (formerly NextAuth) have better TypeScript support, better documentation, and patterns that match current web architecture. For new projects, especially Next.js or other modern frameworks, Passport feels like reaching for the old reliable when newer options fit better.

SuperTokens15.3k★

SuperTokens is the open source authentication platform: signup, password reset, social login, multi-factor auth, without Auth0 prices or Firebase lock-in. It handles session management, email verification, passwordless login, and social OAuth out of the box. Self-hosting is free with all features. The managed cloud has a free tier up to 5,000 monthly active users (MAUs), which covers most startups. Paid tiers kick in at scale. The catch: the self-hosted version requires running a Java-based core service alongside your app. That's a real dependency: Java runtime, separate process, separate database. The cloud version eliminates this but you're trusting a smaller company with your auth. And the SDK ecosystem, while growing, is narrower than Auth0's. Check that your framework is supported before committing.

ZITADEL15.0k★

ZITADEL is a self-contained identity platform: login, signup, SSO, multi-factor auth, roles, and organizations in one box. Self-hosted it is free under AGPL-3.0 with nothing gated, which means unlimited users, SSO, MFA, RBAC, custom branding, audit logs, and Actions for running your own logic on auth events. That is the reason to look at this. Self-hosting needs a Postgres-compatible database and runs as a single binary or a Docker container. The docs are good, but identity is complex by nature, so plan a day for the first real configuration and a few hours a month after that. CockroachDB is supported if you need high availability, and a VM in the $20 to $40 a month range handles thousands of users. The cloud tier is where you have to read carefully. Free covers 100 daily active users, and daily actives count stricter than the monthly-active numbers most competitors quote, so do not assume it is generous because the number looks round. Above that, Pro is $100 a month and includes 25,000 daily active users, a custom domain, and an uptime guarantee. Data residency in the EU, US, Switzerland, or Australia now comes with the free tier, which it did not a year ago. Solo devs and side projects: self-host, or live inside 100 daily actives. Small teams past that: $100 a month for Pro, or self-host. Larger orgs: self-host, or negotiate enterprise. The catch is the license. AGPL-3.0 means you cannot embed ZITADEL inside a proprietary product you distribute without buying a commercial license. Running it as your own auth layer is fine, and that covers most people. The community is also smaller than Keycloak's, so an edge case may not have a Stack Overflow answer yet. And Zitadel Next, their new local-auth direction, is in alpha, so expect the platform to keep moving.

oauth2-proxy15.0k★

Internal dashboards, admin panels and staging environments rarely ship with a login worth trusting. oauth2-proxy sits in front of them and handles it. It's a reverse proxy that forces users to authenticate with Google, GitHub, Azure AD, or dozens of other identity providers before the request reaches your app. One deployment, and everything behind it inherits a real identity provider. Fully free under MIT. No paid tier. You deploy it as a container or binary, configure your identity provider, and point it at whatever you want to protect. It handles the entire OAuth2/OIDC flow. Your backend app never needs to know about authentication. The catch: it's authentication only, not authorization. Everyone who logs in gets the same access. There's no built-in role system or per-path permissions. For that, you need something like Authelia or Authentik. And the configuration is YAML/CLI flags with a lot of options. Getting it right the first time takes some trial and error, especially with less common identity providers.

Logto14.6k★

Logto is an auth platform you can self-host for free or use their cloud: login, signup, SSO, MFA, and user management for SaaS apps. Drop in their SDK, get a polished login experience, manage users through their admin console, done. It handles the stuff that's hard to build correctly: OAuth 2.0/OIDC compliance, social login (Google, GitHub, Apple), passwordless auth, MFA, organization management for B2B SaaS, and RBAC (role-based access control, controlling who can do what in your app). MPL-2.0 license. The self-hosted version is fully featured, no artificial feature gates to push you to cloud. The catch: auth is a 'get it wrong and you're on the news' category. Logto is well-built but younger than Auth0 or Keycloak. If you self-host, you're responsible for security patches and uptime of your auth system, and that's not something you want going down at 2am.

Ory Kratos13.9k★

Ory Kratos is a headless identity server that handles login, registration, password recovery, and account management without depending on Auth0. It handles the backend logic: password hashing, session management, MFA, social sign-in, and you build whatever frontend you want on top of its API. "Headless" means no built-in UI. Kratos exposes APIs and you render the login forms, registration flows, and account settings pages yourself. This gives you complete control over the user experience but means more work upfront. Kratos handles identity lifecycle: registration, login, logout, account recovery, email verification, settings management, and MFA (TOTP, WebAuthn). It stores identities in Postgres or MySQL. The security model is solid, built by a team that takes auth seriously. Ory Network (the managed cloud) offers a free tier with 25K monthly active users, which is generous. Beyond that, pricing starts at usage-based rates. The catch: the learning curve is steep. Kratos has its own concepts (self-service flows, identity schemas, Jsonnet mappers) that take real time to understand. The documentation is extensive but dense. If you just need "add Google login to my app," Kratos is like bringing a bulldozer to dig a garden hole. Supertokens or even NextAuth are simpler for straightforward auth needs.

Lucia10.4k★

Lucia is an open source auth library you run on your own server, not a hosted service. It handles sessions, cookies, and the messy parts of auth, but you own the database, you own the code, and you control every decision. No redirect to someone else's login page. It works with any database (Postgres, SQLite, MySQL, MongoDB) and any framework (Next.js, SvelteKit, Astro, Express). The API is deliberately minimal: create a session, validate a session, invalidate a session. OAuth, email/password, and magic links are all supported through clean patterns rather than black-box modules. Completely free under the BSD Zero Clause License, one of the most permissive licenses that exists. No paid tier, no cloud service, no upsells. The catch: Lucia deprecated itself in early 2025. The maintainer explicitly recommended using it as a learning resource and pattern guide rather than a production dependency going forward. The code works, but don't expect new features or security patches. If you're starting fresh, look at Better Auth (similar philosophy, actively maintained) or Logto for a self-hostable auth server with a UI. If you want a managed service and don't mind the vendor dependency, Clerk or Auth0 handle everything but you lose control.

casl7.1k★

CASL handles authorization: who can do what to which resources in your app. Define abilities in one place, enforce them on both frontend and backend. The entire library is 6KB minzipped and MIT licensed. The mental model is simple. You declare rules like "editors can update articles they own" using a readable DSL, then check permissions with can and cannot methods anywhere in your code. Works with React, Vue, Angular, Prisma, and Mongoose out of the box. Rules serialize to JSON, so the same permission set travels from API to UI without duplication. Solo developers building anything with user roles need this. Teams get consistent authorization logic across the stack without rolling their own RBAC from scratch. Scales from "admin vs user" to complex attribute-based access control without swapping libraries. The catch: it is authorization, not authentication. You still need something handling login and identity. CASL just decides what authenticated users are allowed to touch.

authlib5.4k★

Authlib is the Python library for building OAuth and OpenID Connect into your own app. It implements OAuth 1.0, OAuth 2.0, OIDC, and JWT, and works across Flask, Django, FastAPI, and Starlette, so you can build both sign-in flows and your own authorization server. BSD-3-Clause and free, with a commercial license available for teams that want it. This is a low-level toolkit, not a hosted login button. You wire up token storage, the framework integration, and the flow details yourself, and getting OAuth and OIDC right takes actual security knowledge, the kind of thing where a small mistake is a real vulnerability. That is the price of control: nothing leaves your infrastructure and you are not paying per active user, but you own the correctness. For Python teams that need standards-compliant auth they fully control, this is one of the best options going. Solo and small teams: free, just budget the time to implement carefully. Teams that want a support contract and a commercial license: Authlib sells one at $1000/year, or $2000 by invoice. If what you actually want is sign-in without building any of it, that is Auth0, Clerk, or Cognito, and you pay them per user to skip this work. The catch is responsibility. Authlib hands you correct, well-built primitives; it does not hand you a finished, audited auth system. If your team does not have someone comfortable with OAuth's sharp edges, a hosted provider is the safer call even at the per-user price.

Apache Shiro4.5k★

Apache Shiro is a security library Java developers drop into an app to handle logins, permissions, password hashing, and user sessions. Its pitch is independence. It works in plain Java programs, not just web apps, and does not force Spring or an application server on you. Apache 2.0, free, and run by the Apache Software Foundation. Nothing to host. You add the Maven dependencies, configure realms (where your users live) and filter chains, and it runs inside your app. The ops burden is upgrades. Version 3 became the current line in June 2026 and needs Java 17, Jakarta EE 9 or later, and Spring 6 or later if you use Spring. The EhCache and Hazelcast modules are gone in favor of JCache, and 3.0 ships other breaking changes. Free at every size. Teams already on Spring Boot should use Spring Security, which has first-party OAuth 2.0 and SAML support. Shiro only gets OAuth through community integrations like pac4j. Pick Shiro for non-Spring apps, or when you want sessions without a web container. The catch: 2026 has been a rough security year. The project published ten CVEs after none since 2023, including a session fixation bug in default configurations. One of them affects 2.x through 3.0.0, and the only upgrade the advisory names is 3.0.1. Plan the v3 migration now.

AspNet.Security.OAuth.Providers2.5k★

Social login for ASP.NET Core, solved as a NuGet package. AspNet.Security.OAuth.Providers is a collection of middleware covering GitHub, Twitter/X, Dropbox, and dozens of other OAuth providers, so sign-in-with-anything becomes a few lines in your startup code instead of a hand-rolled OAuth dance. Free and open source. There's nothing to host. Each provider ships as its own package, so you install only what you use, and configuration is a client ID plus a secret. Kevin Chalet (the OpenIddict author) and Martin Costello maintain it actively, which matters more than usual for security middleware. The maintainers themselves point new applications toward the OpenIddict client, which handles the same providers plus full OpenID Connect. Existing ASP.NET Core apps that just need social sign-in are still well served here. Full identity platforms like Authentik (goauthentik/authentik) or Keycloak (keycloak/keycloak) solve a different, bigger problem. The catch: this is auth middleware, not user management. Accounts, sessions, roles, and MFA are still your job, and for greenfield projects the maintainers' own advice is to start with OpenIddict instead.

accesscontrol2.3k★

AccessControl answers one question in your Node backend: can this role do this to that resource? You declare roles and grants in a chainable API, and it handles RBAC and ABAC together: role inheritance, deny overrides, own-versus-any ownership checks, and attribute filtering that strips fields a role shouldn't see. MIT and free. There is nothing to operate. It's an in-process npm library with no service, no database, no policy server. The 3.0 rewrite turned it into a fuller policy engine, with condition expressions, mandatory gates, and async conditions, so it now covers ground that used to require an external service. Use it when hand-rolled role checks start spreading through your codebase and you're not ready for a dedicated policy service. CASL and node-casbin are the OSS competition; Oso, Cerbos, and Permit.io are the paid services this keeps you from needing early. Free at any team size. The catch: it's one maintainer's project. Development is active, but bus factor is the standing risk, and the 3.x policy engine is a big fresh rewrite, so expect some API churn while it settles.

authorizer2.0k★

Authorizer is a self-hosted auth server that replaces Auth0, Firebase Auth, or Supabase Auth. Bring your own database (Postgres, MySQL, SQLite, MongoDB, and 7 more), deploy it, and own every byte of user data. Email/password, social logins (Google, GitHub, Apple, Facebook, LinkedIn), magic links, MFA, and full OAuth2/OIDC compliance. One-click deploy buttons for Railway, Heroku, and Render lower the barrier. For production you need to manage TLS, database backups, Redis for sessions, and an SMTP server for email verification. The Go binary runs in Docker with non-root containers. SDKs cover JavaScript, React, Vue, Svelte, and Go. Privacy-conscious teams or anyone in a regulated industry who cannot send user data to a third party: this is built for you. Solo developers who already run Postgres can colocate auth with their data and skip the monthly Auth0 bill entirely. The catch: you are your own auth provider now. Auth is high-stakes surface area, and any misconfiguration is on you. The project has a small maintainer team, so security patches may lag behind commercial providers. The v1-to-v2 migration is a breaking change. Some SDKs (React Native, Flutter, Python) are still on the roadmap.