Auth

Authentik20.7k★

Authentik is the identity provider that makes Keycloak look like enterprise bloatware. Written in Python with a visual flow editor, it lets you build custom auth journeys — passwordless for some users, MFA for others — without touching code. SSO, SAML, OIDC, LDAP, and SCIM all work out of the box. If you're self-hosting business apps and need proper SSO without Keycloak's learning curve, Authentik is the default recommendation in 2026. Keycloak (Red Hat) has more features but demands you understand realms, clients, and mappers. Auth0 is the commercial standard but gets expensive fast per monthly active user. Authelia is lighter but designed for reverse proxy auth, not full identity management. The catch: Authentik uses a custom license — the enterprise features (like remote access control, recently moved to free) have historically been gated. The Python stack means heavier resource usage than Go-based alternatives. And while the flow editor is great, complex SAML integrations still require deep identity protocol knowledge.

SuperTokens15.0k★

SuperTokens is the auth solution for developers who want to own their user data without building auth from scratch. Email/password, social login, passwordless, MFA, session management — all self-hosted with prebuilt UI components. It's what you'd build if you had six months and a security team. If you're picking between rolling your own auth (don't) and paying Auth0 prices (ouch), SuperTokens is the middle ground. Auth0 is the commercial standard but expensive at scale. Clerk has better DX but is fully managed. Keycloak is enterprise-grade but complex. Lucia is lightweight but DIY. Best for SaaS founders who need production-ready auth with the option to self-host. The managed cloud has a generous free tier (5K MAU). The prebuilt React components save weeks. The catch: the core is Java, which means heavier infrastructure than Go or Rust alternatives. Some features (multi-tenancy, account linking) are only in the paid tier. The documentation, while good, assumes a specific architecture that may not match yours. And migrating away from SuperTokens' session model later is non-trivial.

Ory Kratos13.5k★

Ory Kratos is headless identity management for developers who want auth as an API, not a UI library. It handles registration, login, MFA, account recovery, and profile management through pure API calls — you build the frontend exactly how you want. No opinionated login pages, no UI components you have to style around. If you're building a custom auth experience and want complete control over every pixel, Kratos gives you the identity backend without the UI opinions. Keycloak is the feature-rich monolith with everything built-in but a steep learning curve. SuperTokens is the developer-friendly middle ground with pre-built UI components. Auth0 is the managed option that gets expensive at scale. The catch: headless means you build everything. Login forms, error handling, email templates, flow orchestration — it's all on you. Kratos is part of a four-product Ory suite (Hydra, Oathkeeper, Keto) that works together, but deploying and connecting all four is serious DevOps work. For most indie projects, Logto or SuperTokens gets you to launch faster with pre-built UI.

ZITADEL13.4k★

ZITADEL is identity infrastructure for SaaS teams who don't want to become Keycloak administrators. Multi-tenancy, event sourcing for complete audit trails, and strong security defaults — all in a single Go binary that deploys in minutes, not days. The event sourcing architecture is the differentiator: every IAM operation is stored as an event, so you can time-travel to see how any object looked at any point. Keycloak stores state and logs changes separately — you're trusting the audit log is correct. Compared to Keycloak (more mature, 30k stars, Apache 2.0), ZITADEL is newer but cleaner for modern SaaS. Compared to Auth0 (commercial, expensive at scale), ZITADEL is free to self-host. Use this when you're building a multi-tenant SaaS and need auth that scales with your customer count without per-user pricing. Skip this if you need the deepest enterprise federation features — Keycloak still wins there. The catch: AGPL-3.0 license as of v3, meaning any modifications must be open-sourced. This is a dealbreaker for some SaaS companies. And the community is 2.5x smaller than Keycloak's, so fewer Stack Overflow answers when you're stuck.

Logto11.8k★

Logto is auth infrastructure that doesn't make you choose between open-source control and modern developer experience. Full OAuth 2.1, OIDC, multi-tenancy, RBAC, and social login — with a clean admin console that makes Keycloak's UI look like a 2005 enterprise portal. The open-source core is genuinely usable, not a demo for the paid tier. If you're building a SaaS and need auth with multi-tenant support, Logto hits the sweet spot between Clerk's polish and Keycloak's power. Clerk is easier to integrate but proprietary and charges per user. Auth.js (Better Auth) gives you full data ownership but requires more wiring. Authentik is the self-hosted alternative with a visual flow editor. The catch: Logto is MPL-2.0 licensed, which is permissive but requires sharing modifications to the MPL-licensed files. The project is younger than Keycloak or Auth0 — enterprise features like SAML support and advanced audit logging are still maturing. And token-based pricing on the cloud tier, while cheaper than per-user pricing, requires understanding your token consumption patterns.

Lucia10.5k★

Lucia was the auth library every indie hacker recommended — simple session management without the bloat of NextAuth or the vendor lock-in of Auth0. Clean API, framework-agnostic, TypeScript-first. Was. Lucia v3 was deprecated in March 2025. The maintainers concluded that the database adapter model was too rigid and recommended just implementing sessions yourself. Better-Auth has emerged as the spiritual successor. NextAuth (Auth.js) is the established alternative. Clerk and Auth0 are the commercial options. Don't use Lucia for new projects. It's now an educational resource — the docs teach you how sessions work, which is genuinely valuable, but the library itself isn't maintained. The catch: if you're already running Lucia v3 in production, it still works — there are no breaking changes. But you're on your own for bug fixes and security patches. Migrate to Better-Auth or roll your own session layer using Lucia's docs as a guide. The BSD-0 license means you can fork it, but nobody is.