Overlap

Auth for Node.js

Auth tools that run on Node.js. The Catch for each, not a winner list.

9 tools · the Catch, not a ranking

ClerkAuth that actually ships with your UI
Loud Catch: Clerk is a paid auth product with a free tier that evaporates as MAUs grow. You are outsourcing login UI and session logic; customization is the Clerk way or a fight. This is not the OSS auth library.
Auth.jsAuthentication for the web, framework-agnostic
You are building the UI, handling edge cases, and managing the infrastructure. Provider quirks require debugging.
Better AuthTypeScript auth that lives in your app, not a rented IdP
The library is free; dashboards, audit, and SSO add-ons are the paid wedge. Starter audit retention is 1 day. This is not a hosted IdP — you still own the database and the incident.
LogtoMPL-2.0 identity platform with a 50k-MAU free Cloud
Cloud Free is for starting out. Passkeys, hiding branding, orgs, MFA, and enterprise SSO live as Pro add-ons. MPL-2.0 is file-level copyleft, not MIT.
SuperTokensApache-2.0 session auth you can self-host with no MAU cap
Three processes, not a single library. ee/ is not Apache. Cloud is MAU-metered; MFA and account-linking have 100 USD/month minima on Cloud. Read the carve-out before you assume the whole repo is Apache-2.0.
KindeHosted auth plus billing, $0 forever, 10,500 MAU, no OSS
Not self-host. Kinde branding stays on Free. SMS is 10 included. Pro is $25/mo to uncap MAU and drop branding. Distinct from Polar (Apache MoR, not an IdP) and Clerk (auth UI, no 0.7% billing take-rate on Free).
WorkOSProprietary AuthKit: first 1M MAUs Free — LOUD not OSS
LOUD: proprietary — not OSS. Vs Clerk/Logto/Kinde/Hanko/Better Auth. Free MAU band is the pitch; paid enterprise features exist — do not invent numbers. Distinct from Clerk, Logto, Kinde, Hanko, and Better Auth.
DescopeProprietary auth: Free Forever 7500 MAUs / 10 tenants / 3 SSO
LOUD: proprietary — not OSS. Free Forever caps are real; above them is paid. Vs Clerk/Logto/Kinde/WorkOS/Hanko/Better Auth. Distinct from Clerk, Logto, Kinde, WorkOS, Hanko, and Better Auth.
SimpleWebAuthnMIT passkeys ceremony library — not an IdP
Passkeys ceremony lib — not Hanko/Better Auth/Auth.js IdP or auth framework. You still store credentials and issue sessions. Distinct from Hanko, Better Auth, and Auth.js.