Casbin
Identity & SSOAuthorization library supporting many access control models
Replaces Auth0 RBAC
Best API Identity & SSO for self-hosting
The 24 best API identity & sso you can self-host, ranked by community traction.
Ory Hydra
Identity & SSOCertified OAuth 2.0 and OpenID Connect server
Replaces Okta, Auth0
SuperTokens
Identity & SSOOpen-source user authentication you can self-host
Replaces Auth0, Firebase Auth
ZITADEL
Identity & SSOCloud-native identity infrastructure with multi-tenancy built
Replaces Auth0, Okta
Logto
Identity & SSODeveloper-friendly authentication and authorization platform
Replaces Auth0, Firebase Auth
Ory Kratos
Identity & SSOHeadless identity and user management API server
Replaces Auth0, Firebase Auth
Open Policy Agent
Identity & SSOGeneral-purpose policy engine for cloud-native stacks
Replaces AWS IAM policies
Hanko
Identity & SSOPasskey-first authentication for modern applications
Replaces Auth0, Clerk
step-ca
Identity & SSOPrivate online certificate authority for internal PKI
Replaces DigiCert
SpiceDB
Identity & SSOOpen-source Zanzibar-inspired permissions database
Replaces Auth0 FGA, OpenFGA
OpenFGA
Identity & SSOHigh-performance fine-grained authorization engine
Replaces Auth0 FGA
Permify
Identity & SSOOpen-source authorization service for fine-grained access
Replaces Auth0 FGA, OpenFGA
Ory Keto
Identity & SSOPermission and authorization server based on Zanzibar
Replaces Auth0 FGA, OpenFGA
Cerbos
Identity & SSOScalable, decoupled authorization service
Replaces Auth0 FGA, OPA
node-oidc-provider
Identity & SSOCertified OpenID Connect and OAuth 2.0 provider for Node.js
Replaces Auth0, Okta
Ory Oathkeeper
Identity & SSOIdentity and access proxy for zero-trust networks
Replaces Cloudflare Access
Supabase Auth
Identity & SSOSmall JWT-based user authentication API service
Replaces Auth0
Authorizer
Identity & SSOOpen-source auth solution with a ready-made UI
Replaces Auth0, Firebase Authentication
privacyIDEA
Identity & SSOSelf-hosted two-factor authentication management
Replaces Duo Security, RSA SecurID
Topaz
Identity & SSOOpen-source authorization with fine-grained access control
Replaces Auth0 FGA
Warrant
Identity & SSOOpen-source authorization service for fine-grained access
Replaces Auth0 FGA
Zentral
Identity & SSOEndpoint identity, configuration and compliance platform
Replaces Jamf, Kandji
WSO2 Identity Server
Identity & SSOOpen-source identity and access management server
Replaces Okta, ForgeRock
Hello Identity Coop
Identity & SSOOpen-source authentication broker for passwordless login
Replaces Auth0, Firebase Auth
No apps match these filters.
At a glance
| App | Deploy effort | Difficulty | Min. RAM | License | ★ Stars |
|---|---|---|---|---|---|
| Casbin | Read-the-docs project | Medium | 128 MB | Apache-2.0 | 20,452 |
| Ory Hydra | Under-an-hour setup | Hard | 256 MB | Apache-2.0 | 17,607 |
| SuperTokens | Under-an-hour setup | Medium | 512 MB | Apache-2.0 | 15,348 |
| ZITADEL | Under-an-hour setup | Medium | 512 MB | Apache-2.0 | 15,305 |
| Logto | Under-an-hour setup | Medium | 512 MB | MPL-2.0 | 14,676 |
| Ory Kratos | Under-an-hour setup | Hard | 256 MB | Apache-2.0 | 13,921 |
| Open Policy Agent | Under-an-hour setup | Medium | 256 MB | Apache-2.0 | 12,362 |
| Hanko | Under-an-hour setup | Medium | 512 MB | AGPL-3.0 | 9,040 |
| step-ca | Under-an-hour setup | Medium | 256 MB | Apache-2.0 | 8,950 |
| SpiceDB | Under-an-hour setup | Hard | 512 MB | Apache-2.0 | 7,146 |
Quick picks
- Most adopted: Casbin (20,452 GitHub stars).
- Lightest footprint: Casbin (from 128 MB RAM, against 4,096 MB for the heaviest here).
- Licensing: 18 of 24 use Apache-2.0; check the rest individually if you plan to modify and redistribute.
Every option here is open-source and self-hostable, tagged API within the identity & sso category. Deploy effort is graded from published container recipes, not vendor claims — see the methodology.