Open Source Clerk Alternatives

Authentication in the TypeScript ecosystem is a half solved problem, in the view of Better Auth's author, and this library is the answer he built: a framework for authentication and authorization that ties itself to no particular web framework. The alternatives handle a basic login and then ask for a lot of extra code for anything past it, and the usual fallback is to hand the whole problem to a third party service.

The answer here is a plugin ecosystem. The core ships a set of features out of the box, and anything more advanced arrives as a plugin, so a feature that would otherwise be a project of its own becomes a small amount of code.

The README names the ground this is meant to cover.

• Framework agnostic: no assumption about which TypeScript framework the application is built on.
• Authorization included: access rules treated as part of the same problem, not a separate library.
• Two factor authentication: available through the plugin system rather than hand rolled.
• Multi tenant support: tenancy handled the same way, again as a plugin.

The project is free and open source under the MIT license, with contributions, feature suggestions and issue reports all invited. Security vulnerabilities go through GitHub Security Advisories, where the maintainers say reports are addressed promptly and reporters credited.

Every team shipping a SaaS product ends up implementing OIDC and OAuth 2.1 again, and Logto exists to stop that. It is open source auth infrastructure for SaaS and AI apps, where multi-tenancy, enterprise single sign on and role-based access control arrive ready to use rather than as workarounds layered onto a simpler product.

Sign-in flows come pre-built with customizable UIs, and SDKs cover more than thirty frameworks including React, Next.js, Angular, Vue, Flutter, Go and Python. The same setup serves single page apps, web apps, mobile apps, APIs, machine to machine calls and CLI tools, while connectors bring in outside identity providers such as Google, Facebook, Azure AD and Okta.

Getting a working instance takes one of three routes.

• Logto Cloud: a fully managed instance with zero setup, the fastest way to try the product.
• GitPod: launches the open source build in a browser in seconds.
• Local development: Docker Compose brings the stack up, or npm init runs it on Node.js against your own PostgreSQL.

Organization RBAC, member invitations and just-in-time provisioning cover the multi-tenant side, with SAML alongside the OAuth family for enterprise customers who need it.

Beyond the standard protocols, Logto documents support for Model Context Protocol and agent-based architectures, which matters when the thing signing in is not always a person.

SuperTokens adds secure login and session management to an application without handing your user table to somebody else. It is an open-core alternative to proprietary login providers, free with no limit on the number of users, and deployed on premises so the data sits in a database you control.

The design splits into three parts. A frontend SDK renders login widgets and manages session tokens, a backend SDK exposes the sign-up, sign-in, sign-out and refresh APIs your frontend calls, and the SuperTokens Core is an HTTP service holding the auth logic and database operations the backend SDK talks to. The core is Java, shipped with its own JDK in the binary and Docker image, so running it resembles running any other HTTP microservice.

Features are deliberately decoupled, so you can adopt only the pieces you need.

• Login methods: passwordless, social, email password and phone password sign-in.
• Session management: token handling that also integrates with other login providers, including Auth0.
• Multi-factor authentication: a second factor layered onto any of the login methods.
• Multi-tenancy: organization support with enterprise SSO for customers who bring their own identity provider.
• Authorization: user roles alongside authentication between microservices.

Session verification happens inside the backend SDK without contacting the Java core, so one core instance serves tens of thousands of users. SDKs exist for Node.js, Go, Python, React, React Native and vanilla JavaScript, and a dashboard handles user administration. Least vendor lock-in is an explicit goal, and leaving does not force your users to reset passwords or sign up again.

Hanko handles authentication and user management for an application without binding it to a vendor. It is framework agnostic and built on privacy-first principles, data minimalism and phishing resistance, which is why passkeys sit at the center rather than at the edge of its options.

The project divides into three building blocks. A lightweight backend exposes an API for passwords, passkeys, email passcodes, OAuth SSO, user and session management and JWT issuing. Web components called Hanko Elements provide onboarding, login and profile screens that are customizable with CSS, and a frontend SDK handles the API communication if you would rather build the interface yourself.

Configuration is where most of the flexibility lives.

• Modern methods: passwords, passcodes, passkeys and MFA using TOTP or security keys.
• Federation: OAuth SSO with Apple, Google and GitHub, SAML enterprise SSO and custom OIDC connections.
• Flexible modes: passkey-only, OAuth-only or user-deletable passwords, depending on how strict you want to be.
• Sessions: server-side sessions with remote revocation.
• Extras: webhooks, internationalization with custom translations and a JavaScript SDK.

A quickstart app demonstrates the login experience and doubles as a reference implementation, and Docker Compose files bring up the whole stack locally or just the backend once the extra services are stripped out. Hanko Cloud covers the managed case, and organizations, roles and permissions are listed as in progress.

Hexclave handles everything that surrounds your users, so a new product does not spend its first month rebuilding authentication, billing and email before shipping anything of its own. It arrives as a catalog of apps you switch on as the product needs them, all on the same user model.

Setup is aimed at coding agents. You paste one prompt pointing at the skill documentation and the agent wires up the integration, and an agent can also fetch that documentation with a question and context attached. The SDKs cover Next.js, React and plain JavaScript.

The catalog covers the pieces most products need.

• Authentication: supports passkeys, OAuth and CLI auth from one component, with methods toggled in the dashboard instead of in code.
• Teams and RBAC: add workspaces, email invites and nested roles, with one permission check that behaves the same on server and client.
• API keys: auto-revoke when leaked, work for users and teams, and reveal the secret only once.
• Payments: cover subscriptions, one-time charges and usage metering with credits, billing a person or a team through one model.
• Emails: send transactional and marketing messages from a single API, with themed templates and open and click tracking.
• Analytics: give live active user counts and session replays, queried in plain English or SQL.

Signed webhooks with retries and backoff, a data vault that locks user secrets with your own key, and a launch checklist for domains and secret rotation round out the set. Hexclave is dual licensed under MIT and AGPLv3, in the cloud or self-hosted.

Positioned as an open source alternative to Auth0, Clerk, and Firebase Auth, Authgear is an extensible turnkey solution for consumer authentication needs. It removes the login stack nobody wants to build twice: signup pages, account settings, second factors, session revocation, and the audit trail an enterprise buyer will eventually ask about.

The repository carries four components: the Authgear server itself, AuthUI for login, registration and profile pages, a portal for managing project configuration, and an Admin API exposing a GraphQL interface over services and data. SDKs live in separate repositories, covering web JavaScript with Next.js, Vue, React and Angular, plus React Native, Capacitor, iOS, Android, Flutter, and Xamarin.

The out-of-the-box feature set targets SaaS products and multi-app ecosystems.

• Passwordless login: magic links and one-time passwords over email, SMS, or WhatsApp.
• Passkeys: an anti-phishing alternative to passwords, supporting FIDO2 hardware keys and password managers.
• Multifactor authentication: TOTP through Google Authenticator or Authy, email and SMS codes, and an extra password factor.
• Protocols and SSO: OIDC, OAuth 2.0, and SAML, with enterprise connections to ADFS and LDAP.
• Access control: roles and groups extend access management across the applications Authgear powers.
• Hooks and templates: webhooks and TypeScript hooks fire on events such as a new signup, while email and SMS templates localize per language.

A quick start guide carries tutorials for JavaScript, Go, PHP, Next.js, Laravel, and Spring. Self-hosting instructions cover local development, with a Helm chart as the recommended route to Kubernetes in production, and Authgear Cloud exists for teams who would rather not run it.