Overlap
Auth for Multi-platform
Auth tools that run on Multi-platform. The Catch for each, not a winner list.
7 tools · the Catch, not a ranking
- KeycloakApache-2.0 CNCF-incubation Java IAM: OIDC, OAuth, SAML, LDAP
CNCF Java IAM, OIDC+OAuth+SAML+LDAP. Distinct from authentik (MIT-core Python, no hosted hatch, enterprise/ carve-out). You run a JVM and a database. There is no $0 Keycloak Cloud on the project site.
- CasdoorApache-2.0 UI-first IdP; Hosted Free 25k MAU, self-host primary
UI-first IdP — vs Keycloak/authentik/Kanidm/Logto/Hanko/Zitadel. Hosted Free 25k MAU; self-host uncapped. Distinct from Keycloak, authentik, Kanidm, Logto, Hanko, and Zitadel.
- Ory Open SourceApache-2.0 modular Go IAM: Kratos, Hydra, Keto, Oathkeeper
Vs Keycloak: modular Go you compose, not one Java IAM. LOUD: Ory own compare table still labels Ory Open Source Evaluation and prototyping; FAQ steers prototypes to OSS and scale to OEL/Network — print that. Ory Cloud/Network CUT as the free path. Not a Dex/Keycloak/Casdoor twin if the Catch stays modular-compose.
- Pocket IDBSD-2-Clause passkey-only OIDC IdP; self-host only
Vs Hanko/Authelia/Keycloak/Ory: passkey-ONLY OIDC IdP (no passwords). Homelab/MCP-scoped, not enterprise IAM. Free path is self-host only.
- TinyauthAGPL-3.0 one-binary proxy auth + Certified OIDC
Vs Authelia/Pocket ID: tiny proxy-fronted auth + Certified OIDC in one binary — not Authelia reverse-proxy SSO alone, not passkeys-only Pocket ID. Free path is self-host.
- FusionAuthSource-available CIAM; Community self-host free unlimited users
LOUD: NOT open source — source-available proprietary CE. Vs Keycloak/ZITADEL/Ory: easier admin UX + flat pricing, but you cannot fork freely like Apache/AGPL IdPs. Premium features and FusionAuth Cloud are paid. Ops burden is yours on CE.
- StytchAuth SaaS with no feature gates; free to 10k MAU + 5 SSO/SCIM
Closed SaaS — not Better Auth/Ory self-host. LOUD: SSO/SCIM beyond 5 is $125/connection/mo; brand removal $99/mo; fingerprints $0.005 after 10k. MAU overage metered (no hard cliff). HIPAA/SLA need Enterprise.