Overlap

Auth for Go

Auth tools that run on Go. The Catch for each, not a winner list.

6 tools · the Catch, not a ranking

HankoAGPLv3 passkeys-first auth with a 10k-MAU free Cloud
Split licenses: backend AGPLv3, Elements and frontend SDKs MIT. Cloud Starter Free 10k MAU is the wall — after that you pay. Cloud Console is closed source. AGPL on the API is network copyleft.
ZITADELAGPLv3 identity Cloud at US$0/Month — 100 DAU, not Logto 50k MAU
Loud: the wall is 100 DAU, not Logto 50k MAU. AGPLv3 is network copyleft — Cloud or self-host, the license is loud. Pro is US$100/Month for 25k DAU. Distinct from Hanko passkeys-first Cloud and authentik no-hosted-hatch.
AutheliaApache-2.0 reverse-proxy SSO, not a full IdP like authentik
You run it behind Traefik/Caddy/nginx. Thin proxy SSO, not a full IdP like authentik (flows, LDAP/RADIUS/SAML, enterprise/). No hosted Authelia Cloud. Ops, the user store, and the proxy stay yours.
DexApache-2.0 federated OIDC IdP that owns no user state
Protocol adapter, not a user directory and not a proxy gate. Distinct from Authelia (reverse-proxy SSO) and from authentik/ZITADEL/Keycloak (they store users). Dex owns no user state. You still need an upstream IdP.
CasdoorApache-2.0 UI-first IdP; Hosted Free 25k MAU, self-host primary
UI-first IdP — vs Keycloak/authentik/Kanidm/Logto/Hanko/Zitadel. Hosted Free 25k MAU; self-host uncapped. Distinct from Keycloak, authentik, Kanidm, Logto, Hanko, and Zitadel.
Ory Open SourceApache-2.0 modular Go IAM: Kratos, Hydra, Keto, Oathkeeper
Vs Keycloak: modular Go you compose, not one Java IAM. LOUD: Ory own compare table still labels Ory Open Source Evaluation and prototyping; FAQ steers prototypes to OSS and scale to OEL/Network — print that. Ory Cloud/Network CUT as the free path. Not a Dex/Keycloak/Casdoor twin if the Catch stays modular-compose.