Self-Hosted SSO: Keycloak vs Authentik and Other Auth0 Alternatives

Choose by the job you need done. To give staff single sign-on across your own and self-hosted apps, start with Keycloak or Authentik. For a homelab, use Authelia to put a login in front of apps that have none, or Pocket ID or Rauthy if you want a small, single-purpose OpenID Connect provider. To replace Auth0 inside a product you build, look at Logto, SuperTokens, Hanko, or Ory Kratos with Ory Hydra, and at ZITADEL if your customers are businesses that each need their own organization.

Facts below were checked on October 29, 2026, against each project's repository and documentation, and against pricing pages where a project sells a paid tier. They are linked where we use them and listed under Sources. About PickOpenSource explains how we write guides.

Workforce SSO, forward auth, or customer auth

"Self-hosted SSO" covers three different jobs, and the job decides the shortlist more than any feature list does.

• Workforce SSO for your apps: Keycloak, Authentik, Casdoor, Pocket ID, Rauthy, and goiabada act as an identity provider. Your apps send users to them over OpenID Connect (OIDC), and for some of them SAML, and staff sign in once. Start here if you are replacing Okta; the Okta alternatives page lists more options.
• Forward auth for apps without SSO: Authelia works alongside a reverse proxy such as nginx, Traefik, or Caddy, which checks with Authelia before passing each request to the app. Authentik does the same through its Proxy outpost, and Rauthy has a forward_auth endpoint. Start here if your apps have no login of their own, or one you do not trust.
• Customer auth inside your product: Logto, SuperTokens, Hanko, Ory Kratos with Ory Hydra, and ZITADEL give your own users sign-up, login, and SDKs, the job Auth0 does. Start here if you are replacing Auth0; see also the Auth0 alternatives page.

Every project we list is in the authentication category. If you are also moving your team's passwords in-house, the self-hosted password manager guide covers that side.

The open-source SSO and identity projects compared

Protocols and features

Included means the project's own README or documentation lists the feature. Enterprise license means the project says it needs a paid license when you self-host. Not found means we did not find it in the sources we checked, which is not proof that it is missing. SuperTokens is left out because the sources we checked did not list these protocols, so every cell would read Not found.

Keycloak

Keycloak is a Java identity server and a CNCF incubation project, per its website. It handles single sign-on and identity brokering over OIDC and SAML 2.0, social login, and user federation from LDAP or Active Directory, so it can connect to a directory you already run. Admins use an admin console, and users manage their passwords, 2FA, and sessions in an account console. The features page lists passkeys, the SCIM API, Organizations, WebAuthn, recovery codes, device flow, and DPoP as supported and enabled by default.

Plan the database before you install. The database guide supports PostgreSQL 14 to 18, MariaDB, MySQL 8.0 and 8.4, Microsoft SQL Server, Oracle, and Aurora PostgreSQL, and says the default dev-file database is not suitable for production. The high-availability sizing guide starts from 1,250 MB of memory per pod and one vCPU for every 15 password logins per second, plus 150% headroom. We did not find a built-in forward-auth proxy in its docs. The project sells no paid tier, and it is licensed Apache-2.0. The latest release is 26.8.1, from October 13, 2026.

Authentik

Authentik describes itself as an open-source identity provider for modern SSO. Its repository is MIT licensed except an enterprise directory under the separate authentik EE License, and the code is mainly Python, with Go, Rust, and TypeScript. Its providers cover OAuth2 and OIDC, SAML, SCIM, LDAP, RADIUS, SSF, WS-Fed, RAC for remote access, a Proxy provider for forward auth, and Entra ID and Google Workspace. The Proxy, LDAP, RADIUS, and RAC providers run through an outpost. Passkeys come through the WebAuthn stage, and version 2025.12 added passkey autofill.

Version 2025.10 removed Redis entirely. Caching and WebSockets moved to PostgreSQL, and the release notes expect roughly 50% more database connections. The Docker Compose install asks for at least 2 CPU cores, 2 GB of RAM, and PostgreSQL. The latest release is 2026.8.5, from October 21, 2026.

Pricing as listed on October 29, 2026: the open-source edition is free. Enterprise costs $5 per internal user per month or $0.02 per external user per month, billed annually, and service accounts are free. Enterprise Plus starts at $20,000 a year. Enterprise-only features include the Google Workspace and Entra ID integrations, mTLS, PAM, RADIUS EAP-TLS, and OAuth2 in SCIM.

ZITADEL

ZITADEL is an identity platform written in Go. Its README lists certified OIDC, SAML 2.0, a SCIM 2.0 server, FIDO2 and WebAuthn passkeys, and OTP, U2F, email, and SMS as second factors, along with LDAP and machine-to-machine auth. Tenancy runs from instance to organization to project, so each business customer can get its own organization. It needs PostgreSQL 14 or later and deploys with Docker Compose or Kubernetes. The latest release is v4.20.0, from October 22, 2026.

The server moved from Apache-2.0 to AGPL-3.0 at v3.0, covered under licenses below. ZITADEL Cloud, as listed on October 29, 2026, has a Free plan at $0 for 100 daily active users and Pro at $100 a month for 25,000 daily active users. Enterprise is custom-priced, self-hosted or in the cloud. For a direct comparison, see Keycloak vs ZITADEL.

Authelia

Authelia is an Apache-2.0 Go service built as a companion to reverse proxies. Its README names nginx, Traefik, Caddy, Skipper, Envoy, HAProxy, and Kubernetes ingress. It adds second factors with WebAuthn passkeys, TOTP, and Duo push. It is also an OIDC provider, OpenID Certified for several provider profiles, though the README still describes OIDC support as beta. We did not find SAML.

Users come only from LDAP or a file backend, per the first-factor docs. There is no self-registration, so every account must exist in that backend first. Storage can be PostgreSQL, SQLite3, or MySQL, with Redis for high availability. The latest release is v4.39.28, from September 17, 2026. For how it differs from a full identity provider, see Authelia vs Keycloak.

Casdoor

Casdoor is an Apache-2.0 identity server with a Go backend and a React frontend. Its README lists OAuth 2.0, OIDC, SAML 2.0, CAS, LDAP, SCIM 2.0, WebAuthn, and TOTP. Organizations act as tenants with their own branding. It runs on MySQL, PostgreSQL, SQLite, SQL Server, and other databases, with Redis optional, and deploys with Docker, Docker Compose, or Helm. The latest release is v4.24.0, from October 25, 2026.

Logto

Logto calls itself auth infrastructure for SaaS and AI apps. Its repository is MPL-2.0 and TypeScript, and lists OIDC, OAuth 2.1, SAML, organizations with organization-level RBAC, MFA, and SDKs for more than 30 frameworks. It needs PostgreSQL. Passkey sign-in is supported, but not for users who sign in through enterprise SSO. The latest release is v1.45.0, from October 13, 2026.

Logto Cloud has a free tier, and Pro starts at $24 a month as listed on October 29, 2026. Add-ons are priced separately: $48 for MFA, $48 for Organizations, $48 per enterprise SSO connector, and $96 per SAML app. Check the billing term on the page before you budget.

Ory Kratos with Ory Hydra

Ory Kratos is headless identity management in Go, licensed Apache-2.0. It handles registration and login with passkeys, TOTP, social sign-in, and magic links, but the open-source core ships no login UI, so you build those screens. It runs on PostgreSQL, MySQL, or CockroachDB. SAML, SCIM, and organization SSO need the Ory Enterprise License when you self-host.

Kratos is not an OAuth2 or OIDC provider. Ory Hydra, also Apache-2.0 and Go, is an OpenID Certified OIDC and OAuth 2.1 provider that fills that role when other apps need to sign in through your system. Both are at v26.2.0, released March 20, 2026.

SuperTokens

SuperTokens describes itself as an open-core alternative to Auth0 or AWS Cognito. The core is written in Java and licensed Apache-2.0, except the ee directory, which has its own license. We did not verify its passkey support or database list. The latest release is v12.4.1, from October 23, 2026.

Per the pricing page as listed on October 29, 2026, self-hosting the open-source features is free without limits. Cloud costs $0.02 per monthly active user and is free under 5,000. Paid features are priced on top: MFA at $0.01 per monthly active user and account linking at $0.005, each with a $100 monthly minimum. Dashboard users beyond the first 3 cost $20 each.

Hanko

Hanko positions itself as an open-source alternative to Auth0, Clerk, WorkOS, and Stytch. Per its repository, the Go backend is AGPL-3.0, while Hanko Elements and the frontend SDK are MIT. It supports passkeys, passwords, and passcodes, with TOTP and security keys for MFA, SAML enterprise SSO, and OAuth social logins. Organizations and roles are listed as in progress. It runs on PostgreSQL or MySQL. The latest backend release is v3.1.0, from October 1, 2026. Hanko also offers hosted plans.

Pocket ID

Pocket ID is a BSD-2-Clause OIDC and OAuth 2.0 provider written in Go and OpenID Certified, per its repository. Authentication is passkey-only. The docs cover SQLite by default or PostgreSQL, Docker Compose or a single binary, and a required HTTPS setup. Groups control which users can reach which app, and LDAP sync is set through environment variables. The latest release is v2.19.1, from October 22, 2026.

Rauthy

Rauthy is a lightweight Apache-2.0 OIDC and OAuth2 provider written in Rust. Its README lists passkeys and passkey-only accounts, MFA, a forward_auth endpoint, SCIM v2, an admin UI, and PAM and NSS modules. It uses an embedded Hiqlite database by default, with PostgreSQL optional. The README reports about 40 MB of RAM with Hiqlite, or 35 MB with PostgreSQL, measured with a small user set and allocator tuning, so your own numbers will differ. The latest release is v0.37.2, from October 19, 2026.

goiabada

goiabada is an MIT-licensed OAuth2 and OIDC server in Go that apps use without a vendor SDK. Its README lists SQLite, PostgreSQL, MySQL, and SQL Server, optional 2FA, an admin console, an audit log, and user self-service. A setup wizard generates Docker Compose, Kubernetes, or binary deployments. We did not verify passkey support. The latest release is v1.9.0, published October 29, 2026, the day we checked.

Keycloak or Authentik

Pick Keycloak for an Apache-2.0 project with no paid tier, a choice of databases, and federation from LDAP or Active Directory. Pick Authentik if you also need forward auth, LDAP, or RADIUS through its outposts and can run PostgreSQL alone.

Check Authentik's Enterprise-only list first if you sync users from Google Workspace or Entra ID. For the full side-by-side, see Authentik vs Keycloak.

Moving off Auth0

Bulk-importing users with their existing passwords requires their password hashes from Auth0, and the export has several approval steps. Auth0's data export page says hashes are not available through the Management API: you open a support case, and the export is not available on the Free tier. The hash export guide also asks for an RSA 4096-bit PGP key, confirmation from a second tenant admin, and an acknowledgment form signed by a CISO, CSO, or VP. Start that request early.

In the sources we checked, three projects document a password-hash import path:

• ZITADEL: the Auth0 migration guide has you request bcrypt hashes from Auth0 support, merge them with your user export using `zitadel-tools migrate auth0`, and load the result through the admin import API.
• SuperTokens: bulk import accepts bcrypt, Argon2, and Firebase scrypt hashes and needs Core 10.0.0 or later. Auth0 hashes and TOTP data come from Auth0 support.
• Logto: user migration imports Bcrypt, MD5, SHA1, SHA256, and Argon2 hashes, with a Legacy option for others. Keeping Auth0 user IDs works only on self-hosted Logto, and there is no Auth0-specific walkthrough.

Ory's Auth0 migration guide is written for its hosted Ory Network, and we did not confirm how much of it applies to a self-hosted Kratos.

If you cannot get the hashes, Logto's docs describe just-in-time migration as an option, which moves each user over when they next sign in. Users who never sign in during that window will need a password reset, so set an end date and plan the reset emails.

SSO licenses: Apache, MIT, MPL, AGPL, and enterprise directories

Keycloak, Authelia, Casdoor, Rauthy, and Ory Kratos with Ory Hydra are Apache-2.0. Authentik's core and goiabada are MIT, Pocket ID is BSD-2-Clause, and Logto is MPL-2.0.

ZITADEL announced its switch from Apache-2.0 to AGPL-3.0 on March 13, 2025, effective from v3.0, published May 2, 2025. Earlier versions stay Apache-2.0, and so do the APIs, proto definitions, SDKs, examples, Helm chart, and Terraform provider. Hanko's backend is also AGPL-3.0, while its frontend elements and SDK are MIT. Under the AGPL-3.0, if you modify the server and let people use it over a network, you must offer those users the complete corresponding source of your modified version, not just a patch. Running it unmodified does not trigger that network clause.

Open-core projects keep some features under separate terms. Authentik's enterprise directory and SuperTokens' ee directory are not under the open-source license, and self-hosting Kratos with SAML, SCIM, or organization SSO needs the Ory Enterprise License. This is a summary, not legal advice, so read each license before you modify or ship.

How to choose

1. Name the job: SSO for staff, forward auth for apps without a login, or customer auth inside your product.
2. List the protocols your apps speak, such as OIDC, SAML, LDAP, or SCIM, and check them against the protocols table. Treat Not found as something to test, not a missing feature.
3. Decide which paid features you would accept: Authentik Enterprise, the Ory Enterprise License, or SuperTokens' priced add-ons.
4. Read the license if you plan to modify the server, especially for ZITADEL v3 and later or Hanko's backend.
5. Match the database to what you already run: several choices for Keycloak, Casdoor, and goiabada; PostgreSQL for Authentik, ZITADEL, and Logto; SQLite or an embedded store for Pocket ID and Rauthy.
6. If you are leaving Auth0, request the hash export before you pick a cutover date, because it needs a second admin and an executive signature.
7. Pilot with one app and a few test accounts. Test sign-in, MFA enrollment, and account recovery before you move everyone.