Open Source WorkOS Alternatives
A curated collection of the 2 best open source alternatives to WorkOS.
The best open source alternative to WorkOS is Hanko. If that doesn't suit you, we've compiled a ranked list of other open source WorkOS alternatives to help you find a suitable replacement. Other interesting open source alternative to WorkOS is Hexclave.
WorkOS alternatives are mainly Identity & Access Management (IAM). Browse these if you want a narrower list of alternatives or looking for a specific functionality of WorkOS.
Authentication and user management server with passkeys, passwords, MFA and SAML SSO, built to avoid vendor lock-in.
Hanko handles authentication and user management for an application without binding it to a vendor. It is framework agnostic and built on privacy-first principles, data minimalism and phishing resistance, which is why passkeys sit at the center rather than at the edge of its options.
The project divides into three building blocks. A lightweight backend exposes an API for passwords, passkeys, email passcodes, OAuth SSO, user and session management and JWT issuing. Web components called Hanko Elements provide onboarding, login and profile screens that are customizable with CSS, and a frontend SDK handles the API communication if you would rather build the interface yourself.
Configuration is where most of the flexibility lives.
- Modern methods: passwords, passcodes, passkeys and MFA using TOTP or security keys.
- Federation: OAuth SSO with Apple, Google and GitHub, SAML enterprise SSO and custom OIDC connections.
- Flexible modes: passkey-only, OAuth-only or user-deletable passwords, depending on how strict you want to be.
- Sessions: server-side sessions with remote revocation.
- Extras: webhooks, internationalization with custom translations and a JavaScript SDK.
A quickstart app demonstrates the login experience and doubles as a reference implementation, and Docker Compose files bring up the whole stack locally or just the backend once the extra services are stripped out. Hanko Cloud covers the managed case, and organizations, roles and permissions are listed as in progress.
User infrastructure for product teams, bundling authentication, teams, payments, emails and analytics behind one shared user model.
Hexclave handles everything that surrounds your users, so a new product does not spend its first month rebuilding authentication, billing and email before shipping anything of its own. It arrives as a catalog of apps you switch on as the product needs them, all on the same user model.
Setup is aimed at coding agents. You paste one prompt pointing at the skill documentation and the agent wires up the integration, and an agent can also fetch that documentation with a question and context attached. The SDKs cover Next.js, React and plain JavaScript.
The catalog covers the pieces most products need.
- Authentication: supports passkeys, OAuth and CLI auth from one component, with methods toggled in the dashboard instead of in code.
- Teams and RBAC: add workspaces, email invites and nested roles, with one permission check that behaves the same on server and client.
- API keys: auto-revoke when leaked, work for users and teams, and reveal the secret only once.
- Payments: cover subscriptions, one-time charges and usage metering with credits, billing a person or a team through one model.
- Emails: send transactional and marketing messages from a single API, with themed templates and open and click tracking.
- Analytics: give live active user counts and session replays, queried in plain English or SQL.
Signed webhooks with retries and backoff, a data vault that locks user secrets with your own key, and a launch checklist for domains and secret rotation round out the set. Hexclave is dual licensed under MIT and AGPLv3, in the cloud or self-hosted.
