# Rauthy

> Apache-2.0 Rust passkey-forward OIDC+OAuth2 IdP with PAM/NSS

**Category:** DevOps  
**Pricing:** open-source  
**URL:** https://sebadob.github.io/rauthy/  
**GitHub:** https://github.com/sebadob/rauthy  
**Added:** 2026-09-11

---

## The Hook

Rauthy is the tiny-RAM Rust IdP when Pocket ID is passkey-only and Keycloak/authentik/ZITADEL/Kanidm/Ory are heavier IAM stacks — not a hosted free-tier IdP.

## What's Good

Apache-2.0. sebadob/rauthy. OpenID Connect + OAuth 2 provider with passkey-first defaults, PAM/NSS modules for host logins, Hiqlite or Postgres, HA, admin UI, and a low memory footprint aimed at small hardware. Docs at sebadob.github.io/rauthy; source github.com/sebadob/rauthy.

## The Catch

Vs Pocket ID (passkey-only OIDC), Keycloak/authentik/ZITADEL/Kanidm/Ory (fuller IAM/CIAM lanes): Rauthy is a self-host Rust IdP with PAM/NSS — not a hosted free-tier IdP and not “enterprise IAM in a box” marketing. You still run the binary, pick Hiqlite vs Postgres, and own TLS/clients/ops.

## Verdict

Apache-2.0 Rust IdP. Free forever self-host; tiny RAM, not a free Cloud seat.