Open Source Amazon Cognito Alternatives

Keycloak adds authentication to applications and secures services with minimal effort, so a team never has to store users or write a login flow of its own. Credentials, sessions and account recovery move out of the application entirely, which is where most of the security bugs in homegrown auth tend to live.

Beyond sign-in, the server covers user federation, strong authentication, user management and fine-grained authorization. The project publishes an operator package for Kubernetes and tracks open source best practice and security scorecard ratings in public, both of which matter for something sitting on the critical path of every login.

Running and working on the server follows a short set of paths.

• Distribution start: download a release, unzip it and run the kc script in development mode.
• Container start: the published image from the project registry starts the same way with one command.
• Building from source: a separate guide covers compiling the server for contributors.
• Testing: guides exist both for running the test suite and for writing new tests.
• Related projects: client libraries, quickstarts and a Node.js adapter live in their own repositories.

Help arrives through documentation, a mailing list for general questions and chat channels split between user help and design discussion, while security vulnerabilities follow a documented disclosure process instead of the public issue tracker. Contributors are asked to read the guide and the code of conduct first, and joining a maintainer area is offered as a way to shape where the project goes.

Authentication in the TypeScript ecosystem is a half solved problem, in the view of Better Auth's author, and this library is the answer he built: a framework for authentication and authorization that ties itself to no particular web framework. The alternatives handle a basic login and then ask for a lot of extra code for anything past it, and the usual fallback is to hand the whole problem to a third party service.

The answer here is a plugin ecosystem. The core ships a set of features out of the box, and anything more advanced arrives as a plugin, so a feature that would otherwise be a project of its own becomes a small amount of code.

The README names the ground this is meant to cover.

• Framework agnostic: no assumption about which TypeScript framework the application is built on.
• Authorization included: access rules treated as part of the same problem, not a separate library.
• Two factor authentication: available through the plugin system rather than hand rolled.
• Multi tenant support: tenancy handled the same way, again as a plugin.

The project is free and open source under the MIT license, with contributions, feature suggestions and issue reports all invited. Security vulnerabilities go through GitHub Security Advisories, where the maintainers say reports are addressed promptly and reporters credited.

Single sign-on usually arrives as a hosted service with your directory inside it. Authentik is the identity provider you run yourself, sitting between users and every application they log into and issuing the assertion or token each one expects, so accounts live in one place instead of being duplicated across a dozen services.

Protocol coverage is the practical reason to reach for it. SAML, OAuth2 and OIDC serve modern web applications, while LDAP and RADIUS reach the older software and network equipment that never learned either. The same project is designed to scale from a small home lab to a large production cluster without changing tools along the way.

Installation follows the size of what you are running.

• Docker Compose: the recommended route for small and test deployments.
• Kubernetes: an official Helm chart is maintained for larger setups.
• AWS CloudFormation: official templates deploy the stack on AWS.
• DigitalOcean Marketplace: a one click app image for a quick managed host.
• Enterprise offering: a paid tier aimed at organizations replacing an existing provider such as Okta, Auth0, Entra ID or Ping Identity.

The repository carries separate licenses for the core, the website and the enterprise directory, so check which one covers the part you intend to modify. Developer documentation explains local build environments, testing your changes and the contribution process, and there is a dedicated security policy for reporting vulnerabilities rather than filing them as public issues.

Teams outgrow simple authentication the moment they start selling to other companies. ZITADEL is an open source identity and access management platform built for that point, giving SaaS products, B2B platforms and self-hosted stacks single sign on, MFA, passkeys, OIDC, SAML, SCIM and a multi-tenancy model in one deployment.

The architecture pairs a relational core with an event-driven design where every mutation is written as an immutable event, so the audit trail is a complete stream you can read through the API or push to outside systems with webhooks. Tenancy runs from the identity system down to organizations and projects, with isolated data and policy scoping at each level.

Everything the platform does is reachable over a typed interface.

• API-first surface: every resource and action is exposed over connectRPC, gRPC and HTTP JSON APIs.
• Authentication breadth: passkeys, OTP by app, email or SMS, LDAP, social and enterprise identity providers, and machine to machine flows.
• Actions: webhooks and custom code enrich tokens or run at defined points in a flow.
• Provisioning: a SCIM 2.0 server and role retrieval cover onboarding and authorization for enterprise customers.
• Self-service: registration with email and phone verification, an administration console, and branding set per organization.

Self-hosting runs on PostgreSQL 14 or newer and installs through Docker Compose or Kubernetes, with zero-downtime updates and no external session store to scale horizontally. The hosted service runs the same codebase, so moving between the two is not a change of product.

Every team shipping a SaaS product ends up implementing OIDC and OAuth 2.1 again, and Logto exists to stop that. It is open source auth infrastructure for SaaS and AI apps, where multi-tenancy, enterprise single sign on and role-based access control arrive ready to use rather than as workarounds layered onto a simpler product.

Sign-in flows come pre-built with customizable UIs, and SDKs cover more than thirty frameworks including React, Next.js, Angular, Vue, Flutter, Go and Python. The same setup serves single page apps, web apps, mobile apps, APIs, machine to machine calls and CLI tools, while connectors bring in outside identity providers such as Google, Facebook, Azure AD and Okta.

Getting a working instance takes one of three routes.

• Logto Cloud: a fully managed instance with zero setup, the fastest way to try the product.
• GitPod: launches the open source build in a browser in seconds.
• Local development: Docker Compose brings the stack up, or npm init runs it on Node.js against your own PostgreSQL.

Organization RBAC, member invitations and just-in-time provisioning cover the multi-tenant side, with SAML alongside the OAuth family for enterprise customers who need it.

Beyond the standard protocols, Logto documents support for Model Context Protocol and agent-based architectures, which matters when the thing signing in is not always a person.

SuperTokens adds secure login and session management to an application without handing your user table to somebody else. It is an open-core alternative to proprietary login providers, free with no limit on the number of users, and deployed on premises so the data sits in a database you control.

The design splits into three parts. A frontend SDK renders login widgets and manages session tokens, a backend SDK exposes the sign-up, sign-in, sign-out and refresh APIs your frontend calls, and the SuperTokens Core is an HTTP service holding the auth logic and database operations the backend SDK talks to. The core is Java, shipped with its own JDK in the binary and Docker image, so running it resembles running any other HTTP microservice.

Features are deliberately decoupled, so you can adopt only the pieces you need.

• Login methods: passwordless, social, email password and phone password sign-in.
• Session management: token handling that also integrates with other login providers, including Auth0.
• Multi-factor authentication: a second factor layered onto any of the login methods.
• Multi-tenancy: organization support with enterprise SSO for customers who bring their own identity provider.
• Authorization: user roles alongside authentication between microservices.

Session verification happens inside the backend SDK without contacting the Java core, so one core instance serves tens of thousands of users. SDKs exist for Node.js, Go, Python, React, React Native and vanilla JavaScript, and a dashboard handles user administration. Least vendor lock-in is an explicit goal, and leaving does not force your users to reset passwords or sign up again.

Ory Kratos lifts identity out of application code and puts it behind HTTP APIs. Login, registration, account recovery, verification and profile management become flows your services consume, rather than features every team rewrites once per product.

It is API first and interface agnostic, with both browser-based and native app flows, so any framework can drive it. Identity schemas and traits define what a user record holds, admin APIs cover lifecycle management, and the wider Ory stack adds OAuth2, OpenID Connect and access control when you need them.

Self-hosting is treated as a first-class path, not a courtesy.

• Platforms: installs on Linux, macOS, Windows and Docker, or builds from source.
• Databases: PostgreSQL, MySQL and CockroachDB are the supported stores.
• Kubernetes: deploying to Kubernetes and other orchestrators is covered in the install guide.
• Multi-factor: MFA belongs to the core flow set rather than arriving as an add-on.
• Migration path: pairing Kratos with Ory Hydra replaces the OAuth2 and OpenID Connect side of an existing provider while clients keep speaking the same protocols.

The open source distribution carries no license requirements and suits individuals, researchers and workloads that can live without an SLA. A managed equivalent runs the same server on the Ory Network, API compatible with what you would host yourself, for teams that would rather not operate identity infrastructure at all.

Positioned as an open source alternative to Auth0, Clerk, and Firebase Auth, Authgear is an extensible turnkey solution for consumer authentication needs. It removes the login stack nobody wants to build twice: signup pages, account settings, second factors, session revocation, and the audit trail an enterprise buyer will eventually ask about.

The repository carries four components: the Authgear server itself, AuthUI for login, registration and profile pages, a portal for managing project configuration, and an Admin API exposing a GraphQL interface over services and data. SDKs live in separate repositories, covering web JavaScript with Next.js, Vue, React and Angular, plus React Native, Capacitor, iOS, Android, Flutter, and Xamarin.

The out-of-the-box feature set targets SaaS products and multi-app ecosystems.

• Passwordless login: magic links and one-time passwords over email, SMS, or WhatsApp.
• Passkeys: an anti-phishing alternative to passwords, supporting FIDO2 hardware keys and password managers.
• Multifactor authentication: TOTP through Google Authenticator or Authy, email and SMS codes, and an extra password factor.
• Protocols and SSO: OIDC, OAuth 2.0, and SAML, with enterprise connections to ADFS and LDAP.
• Access control: roles and groups extend access management across the applications Authgear powers.
• Hooks and templates: webhooks and TypeScript hooks fire on events such as a new signup, while email and SMS templates localize per language.

A quick start guide carries tutorials for JavaScript, Go, PHP, Next.js, Laravel, and Spring. Self-hosting instructions cover local development, with a Helm chart as the recommended route to Kubernetes in production, and Authgear Cloud exists for teams who would rather not run it.