Authentication is the rare feature every application needs and almost none of them want to build, which is exactly why a hosted identity provider is so tempting, and why the bill stings later. Pricing that scales with monthly active users means a basic requirement gets more expensive precisely as you succeed, and your entire user directory ends up in a tenant you do not operate. The open source identity servers here speak the same OAuth, OpenID Connect, and SAML your apps already expect, so adopting one is mostly reconfiguration rather than a rewrite. Run it yourself and the cost stops tracking your user count, while credentials, sessions, and profiles stay inside a database on your own network.
Vault is a tool for securely accessing secrets such as API keys, passwords, and certificates. It provides a unified interface to secrets, tight access control, detailed audit logs, and encryption as a service for data you need to protect.
Keycloak is open source identity and access management for modern applications and services. It helps add authentication with minimal effort and avoids the need to store or authenticate users in each application. It is built for securing services while centralizing identity handling.
Authelia is an open-source authentication and authorization server for single sign-on and two-factor authentication. It provides a web portal for applications and sits in front of them to allow, deny, or redirect requests.
Infisical is an open-source platform for centralizing application configuration and secrets such as API keys and database credentials. Teams use it to sync secrets across projects, environments, infrastructure, and CI/CD workflows while preventing secrets from leaking to git.
authentik is an open-source Identity Provider for modern SSO. It is designed for self-hosting and can fit small labs or large production clusters. It provides a single place to handle authentication and authorization instead of relying on a hosted IdP.
Teleport is an infrastructure access platform for connectivity, authentication, access controls, and audit. It provides one identity and access layer for cloud and on-prem infrastructure, covering human users and workloads. It protects SSH servers, Kubernetes clusters, databases, Windows desktops, web apps, cloud APIs, Git repositories, and MCP servers without long-lived keys or passwords.
Ory Hydra is an OpenID Certified OAuth 2.0 server and OpenID Connect provider. It handles OAuth2 and OpenID Connect flows, token issuance and validation, client management, login and consent orchestration, and JWKS management for SSO, API access, and machine-to-machine authorization.
SuperTokens is an open-core authentication provider for adding login and session management to applications. It is positioned as an alternative to proprietary login providers like Auth0 and AWS Cognito, with on-premises deployment so user data stays in your own database.
ZITADEL is an open-source identity and access management platform for teams that need more than basic authentication. It covers SSO, MFA, passkeys, OIDC, SAML, and SCIM for SaaS products, B2B platforms, and self-hosted IAM stacks, with vendor lock-in avoided through an API-first model.
Casdoor is an open-source identity and access management server with a web UI for managing users, organizations, applications, and identity providers. It covers authentication and single sign-on for teams that need one place to handle access across apps and services.
Ory Kratos is an API-first identity and user management system for cloud native applications. It centralizes login, registration, recovery, verification, and profile management so those flows live outside your application code.
Logto is open-source authentication and authorization infrastructure for SaaS and AI apps. It helps teams build production auth without handling OIDC and OAuth 2.1 details from scratch, while adding multi-tenancy, enterprise SSO, and RBAC for customer-facing products.
Dex is an identity service that uses OpenID Connect to authenticate users for other apps. It sits in front of upstream identity providers and lets client apps talk to one OIDC endpoint instead of handling LDAP, SAML, GitHub, Google, or Active Directory directly.
Hanko is an open source authentication and user management system for apps that need modern sign-in without giving up control of the backend. It is framework-agnostic, privacy-first, and built around data minimization and phishing resistance. You can run it yourself or use Hanko Cloud, with the option to move between self-hosted and managed deployment.
Medplum is a developer platform for building healthcare apps. It bundles identity, clinical data storage, a FHIR API, a web app, server-side logic, SDKs, and React components for teams shipping clinical software.
Conjur provides secrets management and application identity for modern infrastructure. It is built to secure non-human access by managing identities, storing secrets, and controlling access with a policy model for humans and machines.
Janssen Project is an open source identity and access management stack for enterprise digital identity infrastructure. It combines Auth Server, Agama low-code identity orchestration, and the Cedarling policy decision point under one control plane, so teams can run IAM components together instead of stitching separate systems.
The right replacement depends on how much of the identity stack you want to own.
Most complete drop-in: Keycloak Keycloak is the most complete open source replacement for Auth0's core job, bundling a user directory, strong authentication, fine-grained authorization, and user federation behind OIDC and SAML. It runs standalone or clustered from a distribution or a container, and as a CNCF project under Apache 2.0 it is a durable foundation that is unlikely to change license underneath you.
Best developer experience for SaaS: Logto Logto is the closest to Auth0's build-fast developer experience, with pre-built sign-in flows, customizable UIs, and SDKs for more than thirty frameworks. It covers OIDC, OAuth 2.1, and SAML plus multi-tenancy, enterprise SSO, and RBAC aimed at customer-facing products, and runs as a managed cloud service or self-hosted under MPL-2.0.
Best for multi-tenant B2B: ZITADEL ZITADEL is built for B2B products that need strict multi-tenancy, with an identity system, organizations, and projects as first-class concepts and SSO, MFA, passkeys, OIDC, SAML, and SCIM on top. Every change is written as an immutable event, giving an API-accessible audit trail, and the same codebase runs in its cloud or self-hosted.
For teams that already have a user store: Ory Hydra If you already run your own user database and UI, Ory Hydra supplies just the certified OAuth 2.0 and OpenID Connect server: token issuance, client management, and login-and-consent orchestration, with no bundled user management. It pairs with Ory Kratos when you also need identity flows, and self-hosts across PostgreSQL, MySQL, or CockroachDB.
Auth0's console quietly hides how many separate jobs it is doing for you: hosted login pages, a user directory, social and enterprise connections, MFA, machine-to-machine tokens, Rules and Actions, and the Management API. Before choosing a replacement, inventory which of those you actually depend on, because the answer decides the shape of the move. A protocol-focused server like Ory Hydra assumes you bring your own user store and interface, while a full product such as Keycloak, ZITADEL, or Logto ships the directory, admin screens, and sign-in flows together.
The gaps show up in the details Auth0 quietly handled: key rotation, email templates, brute-force protection, anomaly detection, and provider-specific quirks in each social login. Rules and Actions are the sharpest edge, because they usually contain business logic that grew over time; treat them as application code to redesign and test, not snippets to paste over. It also helps to separate customer identity from internal access: if you only need single sign-on in front of apps your team already runs, Authelia and authentik fit that reverse-proxy pattern rather than a full customer-facing product.
Migrations here run app by app, not all at once. Stand up a parallel realm or tenant, move one low-risk application first by repointing its issuer, client ID, secret, callback URLs, scopes, and JWKS, and verify every token claim before touching the next. User exports carry profile fields and metadata, but password hashes migrate only if the target supports the same algorithm; many teams fall back to forced reset or just-in-time rehashing on first login. MFA enrollments, sessions, and refresh tokens rarely move cleanly, so keep Auth0 live and a rollback path ready until real traffic has proven the new system.
Usually not OAuth or OIDC themselves, but discovering everything Auth0 accumulated around your apps: Rules, Actions, custom claims, tenant settings, social providers, email flows, Management API scripts, and hosted-login assumptions. Build an inventory first, then classify each item as standard protocol behavior, product configuration, or custom business logic that has to be rewritten and tested. The protocol swap is the easy part.
Not directly. They are tied to Auth0's runtime, event shape, secrets model, and deployment flow, so you cannot copy them across. Read each one and identify its purpose - claim enrichment, access control, redirects, user normalization, logging, or an external API call - then move that behavior into the new identity system, an application service, or a gateway. Add tests, since these snippets often affect authorization in subtle ways.
Each provider has to be recreated and tested individually. Social login depends on app registrations, callback URLs, requested scopes, and provider-specific profile fields; enterprise SAML adds certificate handling, NameID formats, attribute mappings, and customer-side metadata updates. Do not treat these as bulk configuration. Prioritize your highest-volume providers, and coordinate any enterprise-customer changes well before cutover so nobody's SSO breaks on the switch.
Sometimes, but do not assume it. Auth0 exports can include profile data and metadata, while password-hash availability depends on the connection type and export method, and the target must support the same algorithm and parameters. Many teams instead use a forced password reset, or just-in-time migration that verifies the old credential once on first login and rehashes it in the new system.
Often less than expected. If your apps use standard OIDC flows, the change can be limited to the issuer, discovery URL, client credentials, callback URLs, scopes, and claim mapping. The work grows when apps depend on Auth0-specific claim names, Management API calls, custom logout behavior, or Rule outputs. Test login, token renewal, logout, and authorization checks separately for every application before you retire the old tenant.
Plan them as their own migration stream, because enrolled factors rarely transfer cleanly - authenticator apps, SMS numbers, recovery codes, and WebAuthn credentials usually mean re-enrollment. Most replacements cover the methods well: Hanko is passkey-first, Authelia does WebAuthn, TOTP, and Duo, and ZITADEL and SuperTokens include MFA and passkeys. Decide how support will verify identity during resets before you cut over.
You can do either. Several projects offer a managed cloud on the same codebase - Logto Cloud, ZITADEL Cloud, and Ory Network among them - so you can leave Auth0 without running databases yourself. Self-hosting gives you control over data residency, network boundaries, and custom patches, but your team then owns login availability, upgrades, and emergency fixes. Match the choice to your risk model, not just cost.
