Hosted identity providers charge per monthly active user, which hurts as you grow. The projects below split into two groups: identity servers for a company’s staff (single sign-on to internal apps) and authentication for your own product’s customers.
Identity servers and single sign-on
1
keycloak keycloak/keycloak
The established enterprise identity and access manager: SSO, LDAP, SAML and OpenID Connect. Apache-2.0, a CNCF project.
2
authelia authelia/authelia
A single sign-on and multi-factor portal that sits in front of your web apps. Popular with self-hosters.
3
authentik goauthentik/authentik
A flexible identity provider with a modern admin UI, often chosen as a lighter Keycloak or a self-hosted Okta.
4
zitadel zitadel/zitadel
Identity infrastructure with multi-tenancy built in, useful for B2B SaaS that sells to organisations.
5
casdoor casdoor/casdoor
Identity and access management with a UI, now also positioned as a gateway for AI agents and MCP. Apache-2.0.
Login for your product
6
supertokens-core supertokens/supertokens-core
Names Auth0, Firebase Auth and AWS Cognito as what it replaces. Drop-in login UIs and session management.
7
logto logto-io/logto
Authentication and authorisation for SaaS and AI apps, built on OIDC and OAuth 2.1. MPL-2.0.
8
kratos ory/kratos
Headless identity in Go: you bring the UI. Scales well and is part of the wider Ory stack.
9
hanko teamhanko/hanko
Modern, passkey-first authentication that names Auth0 and Clerk as alternatives.
How to choose
Staff SSO across internal apps: Keycloak, authentik or Authelia. Customer login inside your SaaS: SuperTokens, Logto or Hanko. B2B with many customer organisations: ZITADEL. Identity is security-critical, so favour projects with recent activity and a clear security policy.
How we pick: we start from every public GitHub repository with 1,000+ stars, keep the projects that do the job in the title, and read their descriptions and licenses. Stars show community size, not quality, so we also show maintenance status. Nobody paid to be listed.