Overlap

Auth for Go

Auth tools that run on Go. The Catch for each, not a winner list.

7 tools · the Catch, not a ranking

HankoAGPLv3 passkeys-first auth with a 10k-MAU free Cloud
Split licenses: backend AGPLv3, Elements and frontend SDKs MIT. Cloud Starter Free 10k MAU is the wall — after that you pay. Cloud Console is closed source. AGPL on the API is network copyleft.
ZITADELAGPLv3 identity Cloud at US$0/Month — 100 DAU, not Logto 50k MAU
the wall is 100 DAU, not Logto 50k MAU. AGPLv3 is network copyleft — Cloud or self-host, the license is loud. Pro is US$100/Month for 25k DAU. Distinct from Hanko passkeys-first Cloud and authentik no-hosted-hatch.
AutheliaApache-2.0 reverse-proxy SSO, not a full IdP like authentik
You run it behind Traefik/Caddy/nginx. Thin proxy SSO, not a full IdP like authentik (flows, LDAP/RADIUS/SAML, enterprise/). No hosted Authelia Cloud. Ops, the user store, and the proxy stay yours.
DexApache-2.0 federated OIDC IdP that owns no user state
Protocol adapter, not a user directory and not a proxy gate. Distinct from Authelia (reverse-proxy SSO) and from authentik/ZITADEL/Keycloak (they store users). Dex owns no user state. You still need an upstream IdP.
CasdoorApache-2.0 UI-first IdP; Hosted Free 25k MAU, self-host primary
UI-first IdP — vs Keycloak/authentik/Kanidm/Logto/Hanko/Zitadel. Hosted Free 25k MAU; self-host uncapped. Distinct from Keycloak, authentik, Kanidm, Logto, Hanko, and Zitadel.
Ory Open SourceApache-2.0 modular Go IAM: Kratos, Hydra, Keto, Oathkeeper
Vs Keycloak: modular Go you compose, not one Java IAM. Ory own compare table still labels Ory Open Source Evaluation and prototyping; FAQ steers prototypes to OSS and scale to OEL/Network. Ory Cloud/Network is not the free path. Not a Dex/Keycloak/Casdoor twin.
OAuth2 ProxyMIT CNCF Sandbox reverse-proxy auth gate vs external IdPs
NOT an IdP and NOT a user store — it only gates apps against an upstream provider you already run or rent. Vs Authelia/Tinyauth (proxy SSO / portal), authentik (full IdP), and Dex (federated OIDC IdP that still is not an app-fronting proxy): oauth2-proxy sits in front of apps, talks out to an IdP, and never owns accounts. You still configure the upstream client, cookies/headers, and the protected upstreams.