Stack Gems
Menu
WorkbenchBestNewSkillsLogAboutSubmit

Alternatives · Auth

Hexclave alternatives (2026)

Hexclave: Pitch as Hexclave, not Stack Auth. Cloud Free ≤10k forever or self-host; AGPL server is the loud license.

Its Catch: Mid-rename — Docker images still stackauth/server.

Below: 8 free or free-tier tools from the same category (auth tools), free and open source first, then the closest match by shared tags. Each keeps its own Catch.

  1. 1.Auth.jsAuthentication for the web, framework-agnostic

    Free / OSS · ISC · 28.4k GitHub stars

    VerdictMaximum control for teams willing to own their auth.

    CatchYou are building the UI, handling edge cases, and managing the infrastructure. Provider quirks require debugging.

  2. 2.Better AuthTypeScript auth that lives in your app, not a rented IdP

    Free / OSS · Freemium · 30.4k GitHub stars

    VerdictThe MIT auth library to reach for before Clerk. Framework is free; the dashboard is the upsell.

    CatchThe library is free; dashboards, audit, and SSO add-ons are the paid wedge. Starter audit retention is 1 day. This is not a hosted IdP — you still own the database and the incident.

  3. 3.authentikMIT-core self-hosted IdP; enterprise/ is not MIT

    Free / OSS · OSS/MIT · 26k GitHub stars

    VerdictMIT-core IdP. Self-host is the free path; there is no authentik Cloud.

    Catchenterprise/ is not MIT — EE license, paid seats. No hosted hatch: goauthentik.io/pricing says they do not currently provide a hosted version. You run Postgres and the stack.

  4. 4.ZITADELAGPLv3 identity Cloud at US$0/Month — 100 DAU, not Logto 50k MAU

    Free / OSS · Freemium · 15.3k GitHub stars

    VerdictAGPL identity with a real $0 Cloud. 100 DAU is the meter; self-host if that is a joke.

    Catchthe wall is 100 DAU, not Logto 50k MAU. AGPLv3 is network copyleft — Cloud or self-host, the license is loud. Pro is US$100/Month for 25k DAU. Distinct from Hanko passkeys-first Cloud and authentik no-hosted-hatch.

  5. 5.AutheliaApache-2.0 reverse-proxy SSO, not a full IdP like authentik

    Free / OSS · Apache-2.0 · 29.3k GitHub stars

    VerdictApache-2.0 proxy SSO. Free as in you operate the reverse proxy.

    CatchYou run it behind Traefik/Caddy/nginx. Thin proxy SSO, not a full IdP like authentik (flows, LDAP/RADIUS/SAML, enterprise/). No hosted Authelia Cloud. Ops, the user store, and the proxy stay yours.

  6. 6.KeycloakApache-2.0 CNCF-incubation Java IAM: OIDC, OAuth, SAML, LDAP

    Free / OSS · Apache-2.0 · 37.4k GitHub stars

    VerdictApache-2.0 CNCF IdP. Heavy, complete, self-host. Not authentik.

    CatchCNCF Java IAM, OIDC+OAuth+SAML+LDAP. Distinct from authentik (MIT-core Python, no hosted hatch, enterprise/ carve-out). You run a JVM and a database. There is no $0 Keycloak Cloud on the project site.

  7. 7.DexApache-2.0 federated OIDC IdP that owns no user state

    Free / OSS · Apache-2.0 · 11.2k GitHub stars

    VerdictApache-2.0 OIDC facade. Connectors in, standards out, no user table.

    CatchProtocol adapter, not a user directory and not a proxy gate. Distinct from Authelia (reverse-proxy SSO) and from authentik/ZITADEL/Keycloak (they store users). Dex owns no user state. You still need an upstream IdP.

  8. 8.KanidmMPL-2.0 Rust IdP aiming to replace needing Keycloak

    Free / OSS · Apache-2.0 · 5.5k GitHub stars

    VerdictMPL-2.0 Rust IdP. Self-host free. Not Keycloak.

    CatchRust IdP aiming to replace needing Keycloak — not the Java CNCF suite. Distinct from Keycloak (Apache-2.0 JVM IAM). You still operate the box.

FAQ

What are the best free alternatives to Hexclave?
Auth.js, Better Auth, authentik, ZITADEL, Authelia. All are reviewed on Stack Gems in the same category (auth tools); 8 free or open source.
What is the catch with Hexclave?
Mid-rename — Docker images still stackauth/server.
Is there an open-source alternative to Hexclave?
Yes: Auth.js (ISC), Better Auth (Freemium), authentik (OSS/MIT), ZITADEL (Freemium).

More