Keycloak
Identity & SSOOpen-source identity and access management for modern apps
Replaces Okta, Auth0
Best OAuth Identity & SSO for self-hosting
The 28 best OAuth identity & sso you can self-host, ranked by community traction.
Ory Hydra
Identity & SSOCertified OAuth 2.0 and OpenID Connect server
Replaces Okta, Auth0
SuperTokens
Identity & SSOOpen-source user authentication you can self-host
Replaces Auth0, Firebase Auth
ZITADEL
Identity & SSOCloud-native identity infrastructure with multi-tenancy built
Replaces Auth0, Okta
Logto
Identity & SSODeveloper-friendly authentication and authorization platform
Replaces Auth0, Firebase Auth
Casdoor
Identity & SSOUI-first identity and access management with SSO support
Replaces Auth0, Okta
Apereo CAS
Identity & SSOEnterprise single sign-on server for web applications
Replaces Okta, Ping Identity
Dex
Identity & SSOOpenID Connect identity provider with pluggable connectors
Replaces Okta, Auth0
Pocket ID
Identity & SSOSimple OIDC provider that uses only passkeys
Replaces Auth0, Authelia
Hanko
Identity & SSOPasskey-first authentication for modern applications
Replaces Auth0, Clerk
Kanidm
Identity & SSOModern, simple and secure identity management server
Replaces Active Directory, Okta
node-oidc-provider
Identity & SSOCertified OpenID Connect and OAuth 2.0 provider for Node.js
Replaces Auth0, Okta
Vouch Proxy
Identity & SSOSSO authentication helper for reverse proxies
Replaces Okta Access Gateway
Supabase Auth
Identity & SSOSmall JWT-based user authentication API service
Replaces Auth0
Traefik Forward Auth
Identity & SSOMinimal forward authentication service for Traefik
Replaces Cloudflare Access
SAML Jackson
Identity & SSOSAML and OIDC SSO service bridging enterprise providers
Replaces Auth0, WorkOS
Caddy Security
Identity & SSOAuthentication and authorization plugin for Caddy
Replaces Cloudflare Access
Authorizer
Identity & SSOOpen-source auth solution with a ready-made UI
Replaces Auth0, Firebase Authentication
Authgear
Identity & SSOOpen-source authentication and user management server
Replaces Auth0, Firebase Auth
Rauthy
Identity & SSOLightweight OpenID Connect provider written in Rust
Replaces Keycloak, Auth0
SimpleSAMLphp
Identity & SSOPHP implementation of SAML and identity federation
Replaces Okta, PingFederate
WSO2 Identity Server
Identity & SSOOpen-source identity and access management server
Replaces Okta, ForgeRock
Janssen Project
Identity & SSOCloud-native identity and access management platform
Replaces Okta, Auth0
FusionAuth
Identity & SSOComplete authentication and authorization platform
Replaces Auth0, Okta
OpenUnison
Identity & SSOIdentity management and SSO portal for Kubernetes
Replaces Okta
LemonLDAP::NG
Identity & SSOWeb single sign-on and access management system
Replaces Okta, PingFederate
Ipsilon
Identity & SSOIdentity provider for federated single sign-on
Replaces Okta, PingFederate
Hello Identity Coop
Identity & SSOOpen-source authentication broker for passwordless login
Replaces Auth0, Firebase Auth
No apps match these filters.
At a glance
| App | Deploy effort | Difficulty | Min. RAM | License | ★ Stars |
|---|---|---|---|---|---|
| Keycloak | Under-an-hour setup | Hard | 1,024 MB | Apache-2.0 | 37,335 |
| Ory Hydra | Under-an-hour setup | Hard | 256 MB | Apache-2.0 | 17,607 |
| SuperTokens | Under-an-hour setup | Medium | 512 MB | Apache-2.0 | 15,348 |
| ZITADEL | Under-an-hour setup | Medium | 512 MB | Apache-2.0 | 15,305 |
| Logto | Under-an-hour setup | Medium | 512 MB | MPL-2.0 | 14,676 |
| Casdoor | Under-an-hour setup | Medium | 256 MB | Apache-2.0 | 14,562 |
| Apereo CAS | Under-an-hour setup | Hard | 1,024 MB | Apache-2.0 | 11,387 |
| Dex | Under-an-hour setup | Medium | 128 MB | Apache-2.0 | 11,187 |
| Pocket ID | ≈5-minute setup | Easy | 128 MB | BSD-2-Clause | 9,579 |
| Hanko | Under-an-hour setup | Medium | 512 MB | AGPL-3.0 | 9,040 |
Quick picks
- Most adopted: Keycloak (37,335 GitHub stars).
- Lightest footprint: Vouch Proxy (from 64 MB RAM, against 4,096 MB for the heaviest here).
- Fastest to deploy: Pocket ID (verified single-container compose).
- Licensing: 16 of 28 use Apache-2.0; check the rest individually if you plan to modify and redistribute.
Every option here is open-source and self-hostable, tagged OAuth within the identity & sso category. Deploy effort is graded from published container recipes, not vendor claims — see the methodology.