{"data":[{"slug":"authjs","name":"Auth.js","tagline":"Authentication for the web, framework-agnostic","category":"nextjs","url":"https://authjs.dev","github":"https://github.com/nextauthjs/next-auth","pricing":"open-source","hook":"Auth.js is authentication you own—with all the maintenance that implies.","whatsGood":"Provider support is comprehensive: OAuth, credentials, email magic links, and WebAuthn. The database adapter system works with your existing stack. The v5 rewrite improved Edge Runtime support and TypeScript types significantly.","theCatch":"You are building the UI, handling edge cases, and managing the infrastructure. Provider quirks require debugging.","verdict":"Maximum control for teams willing to own their auth.","addedAt":"2026-08-18","featured":false,"domain":"Next.js","subSpecialty":"Auth","subcategory":"Auth","tags":["sdk","self-host","permissive","auth","active"],"capabilities":["auth"],"surfaces":["Self-host"],"ecosystem":["Node.js","Browser"],"licenseModel":"ISC","githubStars":28365,"starsPerWeek":62,"access":"free","archived":false,"repo":{"createdAt":"2018-01-27","pushedAt":"2026-07-22","license":"ISC","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/authjs","html":"/gems/authjs","markdown":"/gems/authjs.md"}},{"slug":"better-auth","name":"Better Auth","tagline":"TypeScript auth that lives in your app, not a rented IdP","category":"nextjs","url":"https://www.better-auth.com","github":"https://github.com/better-auth/better-auth","pricing":"freemium","hook":"Better Auth is the MIT library that replaced Auth.js for people who still want to own the database.","whatsGood":"Framework is MIT (LICENSE.md). Credentials, social, orgs, passkeys, MCP/agent auth, npx auth init. Hosted dashboard Starter is 0 USD/month (1 seat, 10,000 audit logs/month, 1-day retention). You keep the user table. Works next to Polar. Homepage names OpenAI, Databricks, and Strapi.","theCatch":"The library is free; dashboards, audit, and SSO add-ons are the paid wedge. Starter audit retention is 1 day. This is not a hosted IdP — you still own the database and the incident.","verdict":"The MIT auth library to reach for before Clerk. Framework is free; the dashboard is the upsell.","addedAt":"2026-09-03","featured":false,"domain":"Next.js","subSpecialty":"Auth","subcategory":"Auth","tags":["free-tier","permissive","auth","active"],"capabilities":["auth","typescript"],"surfaces":["Hosted"],"ecosystem":["Node.js","Browser"],"licenseModel":"Freemium","githubStars":30363,"starsPerWeek":241,"access":"free","archived":false,"repo":{"createdAt":"2024-05-19","pushedAt":"2026-10-19","license":"MIT","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/better-auth","html":"/gems/better-auth","markdown":"/gems/better-auth.md"}},{"slug":"logto","name":"Logto","tagline":"MPL-2.0 identity platform with a 50k-MAU free Cloud","category":"nextjs","url":"https://logto.io","github":"https://github.com/logto-io/logto","pricing":"freemium","hook":"Logto is Auth0-shaped identity you can self-host, with a Cloud that is actually $0 to start.","whatsGood":"MPL-2.0. OIDC / OAuth 2.1 / SAML for SaaS: orgs, RBAC, SSO. Cloud Free is 0 USD/mo, no credit card, up to 50,000 MAU. OSS self-host is in the README. Pro from 24 USD/mo.","theCatch":"Cloud Free is for starting out. Passkeys, hiding branding, orgs, MFA, and enterprise SSO live as Pro add-ons. MPL-2.0 is file-level copyleft, not MIT.","verdict":"The MPL-2.0 Auth0-shaped stack. Use it when Clerk MAUs are the product.","addedAt":"2026-09-03","featured":false,"domain":"Next.js","subSpecialty":"Auth","subcategory":"Auth","tags":["self-host","free-tier","copyleft","active"],"capabilities":["identity","oidc","auth"],"surfaces":["Self-host","Hosted"],"ecosystem":["Node.js","Browser"],"licenseModel":"Freemium","githubStars":14691,"starsPerWeek":53,"access":"free","archived":false,"repo":{"createdAt":"2021-06-19","pushedAt":"2026-10-19","license":"MPL-2.0","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/logto","html":"/gems/logto","markdown":"/gems/logto.md"}},{"slug":"authentik","name":"authentik","tagline":"MIT-core self-hosted IdP; enterprise/ is not MIT","category":"nextjs","url":"https://goauthentik.io","github":"https://github.com/goauthentik/authentik","pricing":"open-source","hook":"authentik is the IdP you self-host when Okta is the lock-in and Keycloak is the other mountain.","whatsGood":"MIT outside enterprise/. OIDC, SAML, LDAP, RADIUS, proxy. OSS self-host is Free. Docker Compose or Kubernetes. Flows you can actually read.","theCatch":"enterprise/ is not MIT — EE license, paid seats. No hosted hatch: goauthentik.io/pricing says they do not currently provide a hosted version. You run Postgres and the stack.","verdict":"MIT-core IdP. Self-host is the free path; there is no authentik Cloud.","addedAt":"2026-09-03","featured":false,"domain":"Auth","subSpecialty":"Auth","subcategory":"Auth","tags":["self-host","permissive","license-unclear","auth","active"],"capabilities":["auth","identity"],"surfaces":["Self-host"],"ecosystem":["Python"],"licenseModel":"OSS/MIT","githubStars":26002,"starsPerWeek":73,"access":"free","archived":false,"repo":{"createdAt":"2019-12-30","pushedAt":"2026-10-19","license":"NOASSERTION","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/authentik","html":"/gems/authentik","markdown":"/gems/authentik.md"}},{"slug":"zitadel","name":"ZITADEL","tagline":"AGPLv3 identity Cloud at US$0/Month — 100 DAU, not Logto 50k MAU","category":"nextjs","url":"https://zitadel.com","github":"https://github.com/zitadel/zitadel","pricing":"freemium","hook":"ZITADEL is the AGPL IdP whose Cloud is actually US$0 — until the 100th daily user.","whatsGood":"AGPLv3. Cloud Free is US$0/Month: 100 Daily Active Users, unlimited stored users, 3 identity providers, unlimited organizations. Data residency EU, US, Switzerland, Australia. Self-host the same stack. Not Logto (50k MAU Cloud), not Hanko (10k MAU passkeys), not authentik (MIT-core, no Cloud).","theCatch":"the wall is 100 DAU, not Logto 50k MAU. AGPLv3 is network copyleft — Cloud or self-host, the license is loud. Pro is US$100/Month for 25k DAU. Distinct from Hanko passkeys-first Cloud and authentik no-hosted-hatch.","verdict":"AGPL identity with a real $0 Cloud. 100 DAU is the meter; self-host if that is a joke.","addedAt":"2026-09-03","featured":false,"domain":"Auth","subSpecialty":"Auth","subcategory":"Auth","tags":["self-host","free-tier","copyleft","auth","active"],"capabilities":["auth","identity"],"surfaces":["Self-host","Hosted"],"ecosystem":["Go"],"licenseModel":"Freemium","githubStars":15345,"starsPerWeek":45,"access":"free","archived":false,"repo":{"createdAt":"2020-03-16","pushedAt":"2026-10-16","license":"AGPL-3.0","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/zitadel","html":"/gems/zitadel","markdown":"/gems/zitadel.md"}},{"slug":"authelia","name":"Authelia","tagline":"Apache-2.0 reverse-proxy SSO, not a full IdP like authentik","category":"nextjs","url":"https://www.authelia.com","github":"https://github.com/authelia/authelia","pricing":"open-source","hook":"Authelia is the SSO portal you put behind Traefik when authentik is the other mountain.","whatsGood":"Apache-2.0. OSS self-host, no product pricing page. OpenID Connect 1.0 Provider (OpenID Certified). Passkeys, TOTP, WebAuthn, policies. Companion for Traefik, Caddy, nginx. Go + React, tiny container.","theCatch":"You run it behind Traefik/Caddy/nginx. Thin proxy SSO, not a full IdP like authentik (flows, LDAP/RADIUS/SAML, enterprise/). No hosted Authelia Cloud. Ops, the user store, and the proxy stay yours.","verdict":"Apache-2.0 proxy SSO. Free as in you operate the reverse proxy.","addedAt":"2026-09-03","featured":false,"domain":"Auth","subSpecialty":"Auth","subcategory":"Auth","tags":["self-host","permissive","auth","active"],"capabilities":["auth","sso"],"surfaces":["Self-host"],"ecosystem":["Go"],"licenseModel":"Apache-2.0","githubStars":29306,"starsPerWeek":57,"access":"free","archived":false,"repo":{"createdAt":"2016-12-07","pushedAt":"2026-10-19","license":"Apache-2.0","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/authelia","html":"/gems/authelia","markdown":"/gems/authelia.md"}},{"slug":"keycloak","name":"Keycloak","tagline":"Apache-2.0 CNCF-incubation Java IAM: OIDC, OAuth, SAML, LDAP","category":"nextjs","url":"https://www.keycloak.org","github":"https://github.com/keycloak/keycloak","pricing":"open-source","hook":"Keycloak is the CNCF IdP the JVM shops already run — not authentik with a different coat.","whatsGood":"Apache-2.0. CNCF incubation. OpenID Connect, OAuth 2.0, SAML 2.0, LDAP user federation, identity brokering. Admin console, realms, clients. Self-host is the product.","theCatch":"CNCF Java IAM, OIDC+OAuth+SAML+LDAP. Distinct from authentik (MIT-core Python, no hosted hatch, enterprise/ carve-out). You run a JVM and a database. There is no $0 Keycloak Cloud on the project site.","verdict":"Apache-2.0 CNCF IdP. Heavy, complete, self-host. Not authentik.","addedAt":"2026-09-03","featured":false,"domain":"Auth","subSpecialty":"Auth","subcategory":"Auth","tags":["self-host","permissive","auth","active"],"capabilities":["auth","oidc"],"surfaces":["Self-host"],"ecosystem":["Multi-platform"],"licenseModel":"Apache-2.0","githubStars":37424,"starsPerWeek":54,"access":"free","archived":false,"repo":{"createdAt":"2013-07-02","pushedAt":"2026-10-19","license":"Apache-2.0","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/keycloak","html":"/gems/keycloak","markdown":"/gems/keycloak.md"}},{"slug":"dex-idp","name":"Dex","tagline":"Apache-2.0 federated OIDC IdP that owns no user state","category":"nextjs","url":"https://dexidp.io","github":"https://github.com/dexidp/dex","pricing":"open-source","hook":"Dex is the OIDC adapter in front of GitHub, LDAP, or SAML — it does not keep your users.","whatsGood":"Apache-2.0. Federated OIDC / OAuth 2.0 provider with pluggable connectors (GitHub, Google, LDAP, SAML, OIDC). Apps speak OIDC to Dex once. Go binary, Helm chart, CNCF sandbox.","theCatch":"Protocol adapter, not a user directory and not a proxy gate. Distinct from Authelia (reverse-proxy SSO) and from authentik/ZITADEL/Keycloak (they store users). Dex owns no user state. You still need an upstream IdP.","verdict":"Apache-2.0 OIDC facade. Connectors in, standards out, no user table.","addedAt":"2026-09-03","featured":false,"domain":"Auth","subSpecialty":"Auth","subcategory":"Auth","tags":["self-host","permissive","auth","active"],"capabilities":["oidc","federation"],"surfaces":["Self-host"],"ecosystem":["Go"],"licenseModel":"Apache-2.0","githubStars":11197,"starsPerWeek":19,"access":"free","archived":false,"repo":{"createdAt":"2015-08-17","pushedAt":"2026-10-19","license":"Apache-2.0","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/dex-idp","html":"/gems/dex-idp","markdown":"/gems/dex-idp.md"}},{"slug":"kanidm","name":"Kanidm","tagline":"MPL-2.0 Rust IdP aiming to replace needing Keycloak","category":"rust","url":"https://kanidm.com","github":"https://github.com/kanidm/kanidm","pricing":"open-source","hook":"Kanidm is the Rust identity provider that wants you to stop needing Keycloak.","whatsGood":"MPL-2.0. Self-host IdP at $0. WebAuthn, OAuth2/OIDC, LDAP, RADIUS, SSH. Written in Rust. Docs and first-party tooling at kanidm.com.","theCatch":"Rust IdP aiming to replace needing Keycloak — not the Java CNCF suite. Distinct from Keycloak (Apache-2.0 JVM IAM). You still operate the box.","verdict":"MPL-2.0 Rust IdP. Self-host free. Not Keycloak.","addedAt":"2026-09-04","featured":false,"domain":"Auth","subSpecialty":"Auth","subcategory":"Auth","tags":["self-host","copyleft","auth","active"],"capabilities":["auth","oidc","webauthn"],"surfaces":["Self-host"],"ecosystem":["Rust"],"licenseModel":"Apache-2.0","githubStars":5481,"starsPerWeek":14,"access":"free","archived":false,"repo":{"createdAt":"2019-02-02","pushedAt":"2026-10-18","license":"MPL-2.0","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/kanidm","html":"/gems/kanidm","markdown":"/gems/kanidm.md"}},{"slug":"casdoor","name":"Casdoor","tagline":"Apache-2.0 UI-first IdP; Hosted Free 25k MAU, self-host primary","category":"nextjs","url":"https://casdoor.com","github":"https://github.com/casdoor/casdoor","pricing":"freemium","hook":"Casdoor is Apache-2.0 identity with a web UI when Keycloak feels like an ops novel.","whatsGood":"Apache-2.0. Self-host is primary. Hosted Free: 25k MAU. OAuth/OIDC/SAML, UI for apps and users. Use casdoor.com (casdoor.org 500s).","theCatch":"UI-first IdP — vs Keycloak/authentik/Kanidm/Logto/Hanko/Zitadel. Hosted Free 25k MAU; self-host uncapped. Distinct from Keycloak, authentik, Kanidm, Logto, Hanko, and Zitadel.","verdict":"Apache-2.0 IdP. Self-host primary; Hosted Free 25k MAU.","addedAt":"2026-09-04","featured":false,"domain":"Auth","subSpecialty":"Auth","subcategory":"Auth","tags":["web-ui","self-host","free-tier","permissive","auth","active"],"capabilities":["auth","oidc"],"surfaces":["Self-host","Hosted"],"ecosystem":["Go","Multi-platform"],"licenseModel":"Freemium","githubStars":14599,"starsPerWeek":47,"access":"free","archived":false,"repo":{"createdAt":"2020-10-22","pushedAt":"2026-10-18","license":"Apache-2.0","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/casdoor","html":"/gems/casdoor","markdown":"/gems/casdoor.md"}},{"slug":"simplewebauthn","name":"SimpleWebAuthn","tagline":"MIT passkeys ceremony library — not an IdP","category":"nextjs","url":"https://simplewebauthn.dev","github":"https://github.com/MasterKale/SimpleWebAuthn","pricing":"open-source","hook":"SimpleWebAuthn is the WebAuthn ceremony kit when you already have an IdP and only need passkeys wired correctly.","whatsGood":"MIT. Server and browser helpers for registration/authentication ceremonies. You own sessions and users. No hosted IdP tax for the library itself.","theCatch":"Passkeys ceremony lib — not Hanko/Better Auth/Auth.js IdP or auth framework. You still store credentials and issue sessions. Distinct from Hanko, Better Auth, and Auth.js.","verdict":"MIT WebAuthn helpers. Library only; bring your own IdP.","addedAt":"2026-09-04","featured":false,"domain":"Auth","subSpecialty":"Auth","subcategory":"Auth","tags":["sdk","self-host","permissive","auth","active"],"capabilities":["passkeys","webauthn"],"surfaces":["Self-host"],"ecosystem":["Node.js","Browser"],"licenseModel":"OSS/MIT","githubStars":2370,"starsPerWeek":7,"access":"free","archived":false,"repo":{"createdAt":"2020-05-22","pushedAt":"2026-10-11","license":"MIT","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/simplewebauthn","html":"/gems/simplewebauthn","markdown":"/gems/simplewebauthn.md"}},{"slug":"ory","name":"Ory Open Source","tagline":"Apache-2.0 modular Go IAM: Kratos, Hydra, Keto, Oathkeeper","category":"nextjs","url":"https://www.ory.com/open-source","github":"https://github.com/ory/kratos","pricing":"open-source","hook":"Ory Open Source is the modular Go IAM stack you compose instead of adopting one Java realm.","whatsGood":"Apache-2.0. Self-host Kratos (identity), Hydra (OAuth2/OIDC), Keto (Zanzibar authz), Oathkeeper (IAP). Pick the pieces you need. Same APIs as OEL/Network.","theCatch":"Vs Keycloak: modular Go you compose, not one Java IAM. Ory own compare table still labels Ory Open Source Evaluation and prototyping; FAQ steers prototypes to OSS and scale to OEL/Network. Ory Cloud/Network is not the free path. Not a Dex/Keycloak/Casdoor twin.","verdict":"Apache-2.0 modular Go IAM. Compose pieces; their table still says prototyping.","addedAt":"2026-09-04","featured":false,"domain":"Auth","subSpecialty":"Auth","subcategory":"Auth","tags":["self-host","permissive","auth","active"],"capabilities":["auth","oauth","oidc"],"surfaces":["Self-host"],"ecosystem":["Go","Multi-platform"],"licenseModel":"Apache-2.0","githubStars":13921,"starsPerWeek":32,"access":"free","archived":false,"repo":{"createdAt":"2018-05-29","pushedAt":"2026-07-29","license":"Apache-2.0","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/ory","html":"/gems/ory","markdown":"/gems/ory.md"}},{"slug":"pocket-id","name":"Pocket ID","tagline":"BSD-2-Clause passkey-only OIDC IdP; self-host only","category":"nextjs","url":"https://pocket-id.org","github":"https://github.com/pocket-id/pocket-id","pricing":"open-source","hook":"Pocket ID is the passkey-only OIDC IdP when Hanko still offers passwords and Authelia is proxy SSO.","whatsGood":"BSD-2-Clause. Self-host only — no paid Cloud trap. OIDC Certified. Passkeys only: no password store to mismanage. Homelab and MCP-scoped auth lane.","theCatch":"Vs Hanko/Authelia/Keycloak/Ory: passkey-ONLY OIDC IdP (no passwords). Homelab/MCP-scoped, not enterprise IAM. Free path is self-host only.","verdict":"BSD-2-Clause passkey-only OIDC. Self-host; not enterprise IAM.","addedAt":"2026-09-04","featured":false,"domain":"Auth","subSpecialty":"Auth","subcategory":"Auth","tags":["self-host","permissive","auth","active"],"capabilities":["auth","oidc","passkeys"],"surfaces":["Self-host"],"ecosystem":["Multi-platform"],"licenseModel":"BSD-2-Clause","githubStars":9629,"starsPerWeek":84,"access":"free","archived":false,"repo":{"createdAt":"2024-08-11","pushedAt":"2026-10-19","license":"BSD-2-Clause","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/pocket-id","html":"/gems/pocket-id","markdown":"/gems/pocket-id.md"}},{"slug":"tinyauth","name":"Tinyauth","tagline":"AGPL-3.0 one-binary proxy auth + Certified OIDC","category":"nextjs","url":"https://tinyauth.app","github":"https://github.com/tinyauthapp/tinyauth","pricing":"open-source","hook":"Tinyauth is the single statically linked binary you put in front of Traefik when Authelia is the heavier portal.","whatsGood":"AGPL-3.0. Self-host forever; single statically linked binary, env-var config. OIDC Certified (Basic OP). Works with Traefik/Nginx/Caddy plus LDAP/OAuth.","theCatch":"Vs Authelia/Pocket ID: tiny proxy-fronted auth + Certified OIDC in one binary — not Authelia reverse-proxy SSO alone, not passkeys-only Pocket ID. Free path is self-host.","verdict":"AGPL one-binary proxy auth + Certified OIDC. Self-host forever.","addedAt":"2026-09-04","featured":false,"domain":"Auth","subSpecialty":"Auth","subcategory":"Auth","tags":["self-host","copyleft","auth","active"],"capabilities":["auth","oidc","sso"],"surfaces":["Self-host"],"ecosystem":["Multi-platform"],"licenseModel":"AGPL-3.0","githubStars":8397,"starsPerWeek":92,"access":"free","archived":false,"repo":{"createdAt":"2025-01-19","pushedAt":"2026-10-19","license":"AGPL-3.0","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/tinyauth","html":"/gems/tinyauth","markdown":"/gems/tinyauth.md"}},{"slug":"oauth2-proxy","name":"OAuth2 Proxy","tagline":"MIT CNCF Sandbox reverse-proxy auth gate vs external IdPs","category":"devops","url":"https://oauth2-proxy.github.io/oauth2-proxy/","github":"https://github.com/oauth2-proxy/oauth2-proxy","pricing":"open-source","hook":"oauth2-proxy is the reverse-proxy auth gate in front of your apps when Authelia/Tinyauth/authentik are portals or IdPs and Dex is a federated IdP — not an app-fronting proxy.","whatsGood":"MIT. CNCF Sandbox. oauth2-proxy/oauth2-proxy. Standalone reverse proxy or middleware that authenticates against *external* OAuth2/OIDC providers (Google, GitHub, Azure AD, Keycloak, …) then forwards authorized requests. Email/domain/group allowlists. Docs at oauth2-proxy.github.io/oauth2-proxy; images on quay.io/oauth2-proxy.","theCatch":"NOT an IdP and NOT a user store — it only gates apps against an upstream provider you already run or rent. Vs Authelia/Tinyauth (proxy SSO / portal), authentik (full IdP), and Dex (federated OIDC IdP that still is not an app-fronting proxy): oauth2-proxy sits in front of apps, talks out to an IdP, and never owns accounts. You still configure the upstream client, cookies/headers, and the protected upstreams.","verdict":"MIT CNCF reverse-proxy auth gate. Free forever; bring an external IdP — this is not one.","addedAt":"2026-09-10","featured":false,"domain":"Auth","subSpecialty":"Auth","subcategory":"Auth","tags":["self-host","permissive","sandbox","auth","active"],"capabilities":["oauth","proxy","oidc"],"surfaces":["Self-host"],"ecosystem":["Go","Multi-platform"],"licenseModel":"OSS/MIT","githubStars":15212,"starsPerWeek":32,"access":"free","archived":false,"repo":{"createdAt":"2017-09-29","pushedAt":"2026-10-18","license":"MIT","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/oauth2-proxy","html":"/gems/oauth2-proxy","markdown":"/gems/oauth2-proxy.md"}},{"slug":"rauthy","name":"Rauthy","tagline":"Apache-2.0 Rust passkey-forward OIDC+OAuth2 IdP with PAM/NSS","category":"devops","url":"https://sebadob.github.io/rauthy/","github":"https://github.com/sebadob/rauthy","pricing":"open-source","hook":"Rauthy is the tiny-RAM Rust IdP when Pocket ID is passkey-only and Keycloak/authentik/ZITADEL/Kanidm/Ory are heavier IAM stacks — not a hosted free-tier IdP.","whatsGood":"Apache-2.0. sebadob/rauthy. OpenID Connect + OAuth 2 provider with passkey-first defaults, PAM/NSS modules for host logins, Hiqlite or Postgres, HA, admin UI, and a low memory footprint aimed at small hardware. Docs at sebadob.github.io/rauthy; source github.com/sebadob/rauthy.","theCatch":"Vs Pocket ID (passkey-only OIDC), Keycloak/authentik/ZITADEL/Kanidm/Ory (fuller IAM/CIAM lanes): Rauthy is a self-host Rust IdP with PAM/NSS — not a hosted free-tier IdP and not “enterprise IAM in a box” marketing. You still run the binary, pick Hiqlite vs Postgres, and own TLS/clients/ops.","verdict":"Apache-2.0 Rust IdP. Free forever self-host; tiny RAM, not a free Cloud seat.","addedAt":"2026-09-11","featured":false,"domain":"Auth","subSpecialty":"Auth","subcategory":"Auth","tags":["self-host","permissive","auth","active"],"capabilities":["auth","oidc","passkeys"],"surfaces":["Self-host"],"ecosystem":["Rust"],"licenseModel":"Apache-2.0","githubStars":1382,"starsPerWeek":8,"access":"free","archived":false,"repo":{"createdAt":"2023-07-01","pushedAt":"2026-10-15","license":"Apache-2.0","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/rauthy","html":"/gems/rauthy","markdown":"/gems/rauthy.md"}},{"slug":"supertokens","name":"SuperTokens","tagline":"Apache-2.0 session auth you can self-host with no MAU cap","category":"nextjs","url":"https://supertokens.com","github":"https://github.com/supertokens/supertokens-core","pricing":"freemium","hook":"SuperTokens is session-centric auth that does not meter your self-hosted MAUs.","whatsGood":"Apache-2.0 outside ee/. Frontend SDK + backend SDK + Java core. Passwordless, social, MFA, multi-tenancy. Pricing page: self-hosting the open-source features is free without any limits.","theCatch":"Three processes, not a single library. ee/ is not Apache. Cloud is MAU-metered; MFA and account-linking have 100 USD/month minima on Cloud. Read the carve-out before you assume the whole repo is Apache-2.0.","verdict":"Apache-2.0 auth with no self-host MAU cap. Architecture is three pieces.","addedAt":"2026-09-03","featured":false,"domain":"Next.js","subSpecialty":"Auth","subcategory":"Auth","tags":["self-host","free-tier","license-unclear","auth","active"],"capabilities":["sessions","auth"],"surfaces":["Self-host","Hosted"],"ecosystem":["Node.js","Browser"],"licenseModel":"Freemium","githubStars":15348,"starsPerWeek":43,"access":"free-tier","archived":false,"repo":{"createdAt":"2020-01-05","pushedAt":"2026-10-16","license":"NOASSERTION","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/supertokens","html":"/gems/supertokens","markdown":"/gems/supertokens.md"}},{"slug":"hanko","name":"Hanko","tagline":"AGPLv3 passkeys-first auth with a 10k-MAU free Cloud","category":"nextjs","url":"https://www.hanko.io","github":"https://github.com/teamhanko/hanko","pricing":"freemium","hook":"Hanko is passkeys first, passwords optional, and the Cloud actually starts at $0.","whatsGood":"AGPLv3 core. Passkeys, passcodes, optional passwords, social, SAML. Cloud Starter is Free: 10,000 MAU, no credit card, at hanko.io/pricing. Self-host the backend. Elements and frontend SDKs exist.","theCatch":"Split licenses: backend AGPLv3, Elements and frontend SDKs MIT. Cloud Starter Free 10k MAU is the wall — after that you pay. Cloud Console is closed source. AGPL on the API is network copyleft.","verdict":"Passkeys-first auth. 10k MAU is free; the license split is the other catch.","addedAt":"2026-09-03","featured":false,"domain":"Auth","subSpecialty":"Auth","subcategory":"Auth","tags":["self-host","free-tier","license-unclear","auth","active"],"capabilities":["auth","passkeys"],"surfaces":["Self-host","Hosted"],"ecosystem":["Go"],"licenseModel":"Freemium","githubStars":9043,"starsPerWeek":38,"access":"free-tier","archived":false,"repo":{"createdAt":"2022-03-14","pushedAt":"2026-10-16","license":"NOASSERTION","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/hanko","html":"/gems/hanko","markdown":"/gems/hanko.md"}},{"slug":"hexclave","name":"Hexclave","tagline":"MIT clients / AGPLv3 server auth; Cloud Free ≤10k forever","category":"nextjs","url":"https://hexclave.com","github":"https://github.com/hexclave/hexclave","pricing":"freemium","hook":"Hexclave (ex–Stack Auth) is the user platform with MIT clients, AGPLv3 server, and a Cloud Free tier that is $0 forever up to 10k auth users.","whatsGood":"Clients MIT / server AGPLv3. Cloud Free $0 forever ≤10k auth users (not a trial), 1 admin, email/OAuth/magic links. Self-host the same stack for free. Auth plus teams, RBAC, emails, analytics-shaped extras.","theCatch":"Mid-rename — Docker images still stackauth/server. Cloud Free is PostHog-shaped 10k auth users, not a trial clock. Self-host is heavy (Postgres + ClickHouse + cron + email). AGPLv3 server — commercial license if AGPL does not fit. Vs Better Auth / Clerk / Logto / ZITADEL / Pocket ID.","verdict":"Pitch as Hexclave, not Stack Auth. Cloud Free ≤10k forever or self-host; AGPL server is the loud license.","addedAt":"2026-09-07","featured":false,"domain":"Auth","subSpecialty":"Auth","subcategory":"Auth","tags":["self-host","free-tier","license-unclear","auth","active"],"capabilities":["auth","identity","rbac"],"surfaces":["Self-host","Hosted"],"ecosystem":["Node.js","Multi-platform"],"licenseModel":"Freemium","githubStars":6872,"starsPerWeek":50,"access":"free-tier","archived":false,"repo":{"createdAt":"2024-02-28","pushedAt":"2026-10-17","license":"NOASSERTION","archived":false,"checkedAt":"2026-10-19"},"links":{"self":"/api/gems/hexclave","html":"/gems/hexclave","markdown":"/gems/hexclave.md"}},{"slug":"clerk","name":"Clerk","tagline":"Auth that actually ships with your UI","category":"nextjs","url":"https://clerk.com","github":null,"pricing":"freemium","hook":"Clerk solves auth completely—not just the backend, but the actual forms.","whatsGood":"Integration with Next.js is exceptional: middleware handles route protection, hooks provide user state, and Server Components work seamlessly. Multi-factor authentication, social logins, and organization management are included.","theCatch":"Clerk is a paid auth product with a free tier that evaporates as MAUs grow. You are outsourcing login UI and session logic; customization is the Clerk way or a fight. This is not the OSS auth library.","verdict":"Auth-as-a-feature ships faster than auth-as-a-library.","addedAt":"2026-08-18","featured":false,"domain":"Next.js","subSpecialty":"Auth","subcategory":"Auth","tags":["free-tier","paid-led","auth"],"capabilities":["auth"],"surfaces":["Hosted"],"ecosystem":["Node.js","Browser"],"licenseModel":"Freemium","githubStars":null,"starsPerWeek":null,"access":"paid-led","archived":false,"repo":null,"links":{"self":"/api/gems/clerk","html":"/gems/clerk","markdown":"/gems/clerk.md"}},{"slug":"kinde","name":"Kinde","tagline":"Hosted auth plus billing, $0 forever, 10,500 MAU, no OSS","category":"nextjs","url":"https://kinde.com","github":null,"pricing":"freemium","hook":"Kinde is Clerk-shaped auth that also meters subscriptions — and Free is actually $0 forever.","whatsGood":"Hosted, no OSS product. Free is $0 forever, no credit card, 10,500 MAU. Auth plus subscriptions/billing on Free. Billing take-rate 0.7%. Users charged more than USD $4/month via Kinde do not count as MAU. MFA, social, orgs, custom domain on Free.","theCatch":"Not self-host. Kinde branding stays on Free. SMS is 10 included. Pro is $25/mo to uncap MAU and drop branding. Distinct from Polar (Apache MoR, not an IdP) and Clerk (auth UI, no 0.7% billing take-rate on Free).","verdict":"Hosted auth+billing with a real $0 forever plan. No repo to fork; branding until Pro.","addedAt":"2026-09-03","featured":false,"domain":"Auth","subSpecialty":"Auth","subcategory":"Auth","tags":["free-tier","paid-led","auth","payments"],"capabilities":["auth","billing"],"surfaces":["Hosted"],"ecosystem":["Node.js","Browser"],"licenseModel":"Freemium","githubStars":null,"starsPerWeek":null,"access":"paid-led","archived":false,"repo":null,"links":{"self":"/api/gems/kinde","html":"/gems/kinde","markdown":"/gems/kinde.md"}},{"slug":"workos","name":"WorkOS","tagline":"Proprietary AuthKit: first 1M MAUs Free, not OSS","category":"nextjs","url":"https://workos.com/pricing","github":null,"pricing":"freemium","hook":"WorkOS is enterprise-ready AuthKit when Clerk is consumer auth and you need SSO/Directory Sync later.","whatsGood":"AuthKit first 1M MAUs Free; staging free. SSO, Directory Sync, Audit Log paths when you outgrow DIY. Polished Next.js integration. Check current Enterprise monthly prices on the vendor site.","theCatch":"Proprietary — not OSS. Vs Clerk/Logto/Kinde/Hanko/Better Auth. Free MAU band is the pitch; paid enterprise features exist — check current pricing. Distinct from Clerk, Logto, Kinde, Hanko, and Better Auth.","verdict":"Proprietary AuthKit. First 1M MAUs Free; not open source.","addedAt":"2026-09-04","featured":false,"domain":"Auth","subSpecialty":"Auth","subcategory":"Auth","tags":["free-tier","paid-led","auth"],"capabilities":["auth","sso"],"surfaces":["Hosted"],"ecosystem":["Node.js","Browser"],"licenseModel":"Freemium","githubStars":null,"starsPerWeek":null,"access":"paid-led","archived":false,"repo":null,"links":{"self":"/api/gems/workos","html":"/gems/workos","markdown":"/gems/workos.md"}},{"slug":"descope","name":"Descope","tagline":"Proprietary auth: Free Forever 7500 MAUs / 10 tenants / 3 SSO","category":"nextjs","url":"https://www.descope.com/pricing","github":null,"pricing":"freemium","hook":"Descope is drag-drop auth flows when you want Free Forever MAUs without standing up Keycloak.","whatsGood":"Free Forever: 7500 MAUs / 10 tenants / 3 SSO. Visual flows, passkeys, SSO on the free band. Fast to ship customer auth.","theCatch":"Proprietary — not OSS. Free Forever caps are real; above them is paid. Vs Clerk/Logto/Kinde/WorkOS/Hanko/Better Auth. Distinct from Clerk, Logto, Kinde, WorkOS, Hanko, and Better Auth.","verdict":"Proprietary auth. Free Forever 7.5k MAUs — not open source.","addedAt":"2026-09-04","featured":false,"domain":"Auth","subSpecialty":"Auth","subcategory":"Auth","tags":["free-tier","paid-led","auth"],"capabilities":["auth","flows"],"surfaces":["Hosted"],"ecosystem":["Node.js","Browser"],"licenseModel":"Freemium","githubStars":null,"starsPerWeek":null,"access":"paid-led","archived":false,"repo":null,"links":{"self":"/api/gems/descope","html":"/gems/descope","markdown":"/gems/descope.md"}},{"slug":"fusionauth","name":"FusionAuth","tagline":"Source-available CIAM; Community self-host free unlimited users","category":"nextjs","url":"https://fusionauth.io","github":null,"pricing":"freemium","hook":"FusionAuth is the downloadable auth server when Keycloak is the OSS Java IAM and Auth0 is the per-MAU SaaS bill.","whatsGood":"Community Edition: free forever self-host, unlimited users/MAU — OIDC/OAuth/SAML, MFA basics, themes, APIs, Lambdas, multi-tenancy. Flat paid tiers (not per-MAU) for advanced MFA, breached-password, SCIM, theming extras, support. Cloud hosting optional.","theCatch":"NOT open source — source-available proprietary CE. Vs Keycloak/ZITADEL/Ory: easier admin UX + flat pricing, but you cannot fork freely like Apache/AGPL IdPs. Premium features and FusionAuth Cloud are paid. Ops burden is yours on CE.","verdict":"Free unlimited self-host CIAM. Not OSS; paid for premium/Cloud.","addedAt":"2026-09-04","featured":false,"domain":"Auth","subSpecialty":"Auth","subcategory":"Auth","tags":["self-host","free-tier","paid-led","auth"],"capabilities":["auth","oidc","ciam"],"surfaces":["Self-host","Hosted"],"ecosystem":["Multi-platform"],"licenseModel":"Freemium","githubStars":null,"starsPerWeek":null,"access":"paid-led","archived":false,"repo":null,"links":{"self":"/api/gems/fusionauth","html":"/gems/fusionauth","markdown":"/gems/fusionauth.md"}},{"slug":"stytch","name":"Stytch","tagline":"Auth SaaS with no feature gates; free to 10k MAU + 5 SSO/SCIM","category":"nextjs","url":"https://stytch.com","github":null,"pricing":"freemium","hook":"Stytch is hosted auth without the Auth0 feature cliff when Clerk is consumer-polished and WorkOS is enterprise-SSO-first.","whatsGood":"Pay-as-you-go from $0. Free includes 10k MAU (users+AI agents), unlimited orgs, 5 SSO/SCIM, 1k M2M tokens — MFA/SSO/RBAC/SCIM not gated. B2B multi-tenancy, admin portal components, optional fraud tooling.","theCatch":"Closed SaaS — not Better Auth/Ory self-host. SSO/SCIM beyond 5 is $125/connection/mo; brand removal $99/mo; fingerprints $0.005 after 10k. MAU overage metered (no hard cliff). HIPAA/SLA need Enterprise.","verdict":"Hosted auth, features unlocked. Free to 10k MAU/5 SSO; usage meters after.","addedAt":"2026-09-04","featured":false,"domain":"Auth","subSpecialty":"Auth","subcategory":"Auth","tags":["free-tier","paid-led","auth"],"capabilities":["auth","sso","b2b"],"surfaces":["Hosted"],"ecosystem":["Multi-platform"],"licenseModel":"Freemium","githubStars":null,"starsPerWeek":null,"access":"paid-led","archived":false,"repo":null,"links":{"self":"/api/gems/stytch","html":"/gems/stytch","markdown":"/gems/stytch.md"}}],"meta":{"total":25,"count":25,"offset":0,"limit":null,"sort":"curated","sorts":["curated","catalog","new","stars","trending","name"],"filters":{"subcategory":"auth"},"next":null,"categories":["agents","nextjs","python","shopify","databases","devops","design","observability","rust","payments","comms","notifications","libraries"],"tags":["mcp","cli","tui","api","sdk","desktop-app","web-ui","editor-plugin","self-host","local-first","free-tier","paid-only","paid-led","permissive","copyleft","source-available","license-unclear","coding-agents","local-llm","rag","memory","evals","browser-automation","scraping","sandbox","skills","voice","security","auth","payments","realtime","postgres","vector","kubernetes","containers","observability","testing","workflows","graphics-3d","git","active","stale","archived","young-repo","fast-stars"]}}