Auth tools

• Auth.jsAuthentication for the web, framework-agnostic

  Free / OSS · ISC · 28.4k GitHub stars

  VerdictMaximum control for teams willing to own their auth.

  CatchYou are building the UI, handling edge cases, and managing the infrastructure. Provider quirks require debugging.

• Shopify App JSOfficial Node.js library for Shopify apps

  Free / OSS · OSS/MIT · 543 GitHub stars

  VerdictThe foundation every Node Shopify app needs.

  CatchNode.js only. Some edge cases require diving into implementation details. Version updates can break existing apps.

• SupabaseOpen-source Firebase alternative built on Postgres

  Free / OSS · Freemium · 113k GitHub stars

  VerdictThe Firebase alternative for developers who want real Postgres.

  CatchThe all-in-one convenience creates dependency. Complex queries hit performance limits. Self-hosting requires significant operational knowledge.

• Better AuthTypeScript auth that lives in your app, not a rented IdP

  Free / OSS · Freemium · 30.4k GitHub stars

  VerdictThe MIT auth library to reach for before Clerk. Framework is free; the dashboard is the upsell.

  CatchThe library is free; dashboards, audit, and SSO add-ons are the paid wedge. Starter audit retention is 1 day. This is not a hosted IdP — you still own the database and the incident.

• PocketBaseSQLite backend, auth, and admin UI in one Go binary

  Free / OSS · OSS/MIT · 61.5k GitHub stars

  VerdictThe one-binary BaaS. Perfect until you need Postgres.

  CatchSQLite is the database. Concurrent writes and multi-region are not the product. There is no official hosted PocketBase Cloud. You run the binary, you own backups, you own the disk filling up.

• LogtoMPL-2.0 identity platform with a 50k-MAU free Cloud

  Free / OSS · Freemium · 14.7k GitHub stars

  VerdictThe MPL-2.0 Auth0-shaped stack. Use it when Clerk MAUs are the product.

  CatchCloud Free is for starting out. Passkeys, hiding branding, orgs, MFA, and enterprise SSO live as Pro add-ons. MPL-2.0 is file-level copyleft, not MIT.

• authentikMIT-core self-hosted IdP; enterprise/ is not MIT

  Free / OSS · OSS/MIT · 26k GitHub stars

  VerdictMIT-core IdP. Self-host is the free path; there is no authentik Cloud.

  Catchenterprise/ is not MIT — EE license, paid seats. No hosted hatch: goauthentik.io/pricing says they do not currently provide a hosted version. You run Postgres and the stack.

• ZITADELAGPLv3 identity Cloud at US$0/Month — 100 DAU, not Logto 50k MAU

  Free / OSS · Freemium · 15.4k GitHub stars

  VerdictAGPL identity with a real $0 Cloud. 100 DAU is the meter; self-host if that is a joke.

  Catchthe wall is 100 DAU, not Logto 50k MAU. AGPLv3 is network copyleft — Cloud or self-host, the license is loud. Pro is US$100/Month for 25k DAU. Distinct from Hanko passkeys-first Cloud and authentik no-hosted-hatch.

• AutheliaApache-2.0 reverse-proxy SSO, not a full IdP like authentik

  Free / OSS · Apache-2.0 · 29.4k GitHub stars

  VerdictApache-2.0 proxy SSO. Free as in you operate the reverse proxy.

  CatchYou run it behind Traefik/Caddy/nginx. Thin proxy SSO, not a full IdP like authentik (flows, LDAP/RADIUS/SAML, enterprise/). No hosted Authelia Cloud. Ops, the user store, and the proxy stay yours.

• KeycloakApache-2.0 CNCF-incubation Java IAM: OIDC, OAuth, SAML, LDAP

  Free / OSS · Apache-2.0 · 37.4k GitHub stars

  VerdictApache-2.0 CNCF IdP. Heavy, complete, self-host. Not authentik.

  CatchCNCF Java IAM, OIDC+OAuth+SAML+LDAP. Distinct from authentik (MIT-core Python, no hosted hatch, enterprise/ carve-out). You run a JVM and a database. There is no $0 Keycloak Cloud on the project site.

• DexApache-2.0 federated OIDC IdP that owns no user state

  Free / OSS · Apache-2.0 · 11.2k GitHub stars

  VerdictApache-2.0 OIDC facade. Connectors in, standards out, no user table.

  CatchProtocol adapter, not a user directory and not a proxy gate. Distinct from Authelia (reverse-proxy SSO) and from authentik/ZITADEL/Keycloak (they store users). Dex owns no user state. You still need an upstream IdP.

• KanidmMPL-2.0 Rust IdP aiming to replace needing Keycloak

  Free / OSS · Apache-2.0 · 5.5k GitHub stars

  VerdictMPL-2.0 Rust IdP. Self-host free. Not Keycloak.

  CatchRust IdP aiming to replace needing Keycloak — not the Java CNCF suite. Distinct from Keycloak (Apache-2.0 JVM IAM). You still operate the box.

• CerbosApache-2.0 authZ PDP: YAML policies, run anywhere

  Free / OSS · Apache-2.0 · 4.6k GitHub stars

  VerdictApache-2.0 authorization PDP. Free to run; not an IdP.

  CatchauthZ YAML PDP — not authentik/Keycloak/Better Auth authN/IdP. Check current Hub prices on the vendor site; self-host PDP is the free path. Distinct from authentik, Keycloak, and Better Auth.

• OpenFGAApache-2.0 Zanzibar-style ReBAC with a Check API

  Free / OSS · Apache-2.0 · 6k GitHub stars

  VerdictApache-2.0 ReBAC. Self-host free. Not Cerbos YAML.

  CatchZanzibar-style ReBAC + Check API — not Cerbos YAML ABAC. Vs SpiceDB: CNCF/Okta OpenFGA modeling + Check API lane; SpiceDB is AuthZed production Zanzibar + ZedTokens/Cloud. Distinct from Cerbos.

• TopazApache-2.0 authZ: OPA Rego + embedded Zanzibar in one container

  Free / OSS · Apache-2.0 · 1.4k GitHub stars

  VerdictApache-2.0 combined authZ. Self-host free; not a single-model PDP.

  CatchOne container = OPA Rego + embedded Zanzibar directory (ABAC+ReBAC) — not Cerbos YAML-only PDP and not OpenFGA ReBAC-only Check API. Distinct from Cerbos and OpenFGA.

• CasdoorApache-2.0 UI-first IdP; Hosted Free 25k MAU, self-host primary

  Free / OSS · Freemium · 14.6k GitHub stars

  VerdictApache-2.0 IdP. Self-host primary; Hosted Free 25k MAU.

  CatchUI-first IdP — vs Keycloak/authentik/Kanidm/Logto/Hanko/Zitadel. Hosted Free 25k MAU; self-host uncapped. Distinct from Keycloak, authentik, Kanidm, Logto, Hanko, and Zitadel.

• SimpleWebAuthnMIT passkeys ceremony library — not an IdP

  Free / OSS · OSS/MIT · 2.4k GitHub stars

  VerdictMIT WebAuthn helpers. Library only; bring your own IdP.

  CatchPasskeys ceremony lib — not Hanko/Better Auth/Auth.js IdP or auth framework. You still store credentials and issue sessions. Distinct from Hanko, Better Auth, and Auth.js.

• OpenBaoMPL-2.0 Vault-compatible secrets engine after the Vault fork

  Free / OSS · MPL-2.0 · 8.6k GitHub stars

  VerdictMPL Vault-compat engine. Fork for license, not Infisical DX.

  CatchVault-engine / IdP-secrets lane, not Infisical app-secrets DX. This is the engine/compat fork, not the developer-secrets UI. Don’t assume a Cloud free tier.

• Ory Open SourceApache-2.0 modular Go IAM: Kratos, Hydra, Keto, Oathkeeper

  Free / OSS · Apache-2.0 · 13.9k GitHub stars

  VerdictApache-2.0 modular Go IAM. Compose pieces; their table still says prototyping.

  CatchVs Keycloak: modular Go you compose, not one Java IAM. Ory own compare table still labels Ory Open Source Evaluation and prototyping; FAQ steers prototypes to OSS and scale to OEL/Network. Ory Cloud/Network is not the free path. Not a Dex/Keycloak/Casdoor twin.

• Pocket IDBSD-2-Clause passkey-only OIDC IdP; self-host only

  Free / OSS · BSD-2-Clause · 9.7k GitHub stars

  VerdictBSD-2-Clause passkey-only OIDC. Self-host; not enterprise IAM.

  CatchVs Hanko/Authelia/Keycloak/Ory: passkey-ONLY OIDC IdP (no passwords). Homelab/MCP-scoped, not enterprise IAM. Free path is self-host only.

• TinyauthAGPL-3.0 one-binary proxy auth + Certified OIDC

  Free / OSS · AGPL-3.0 · 8.4k GitHub stars

  VerdictAGPL one-binary proxy auth + Certified OIDC. Self-host forever.

  CatchVs Authelia/Pocket ID: tiny proxy-fronted auth + Certified OIDC in one binary — not Authelia reverse-proxy SSO alone, not passkeys-only Pocket ID. Free path is self-host.

• SpiceDBApache-2.0 Google Zanzibar permissions DB; AuthZed Cloud optional

  Free / OSS · Freemium · 7.2k GitHub stars

  VerdictApache-2.0 Zanzibar permissions DB. Self-host free; AuthZed Cloud optional.

  CatchVs OpenFGA/Cerbos/Topaz: AuthZed production Zanzibar + ZedTokens/Cloud — not OpenFGA CNCF Check API twin, not Cerbos YAML PDP, not Topaz Rego+ReBAC bundle. Free path is self-host; Cloud is paid usage.

• OAuth2 ProxyMIT CNCF Sandbox reverse-proxy auth gate vs external IdPs

  Free / OSS · OSS/MIT · 15.2k GitHub stars

  VerdictMIT CNCF reverse-proxy auth gate. Free forever; bring an external IdP — this is not one.

  CatchNOT an IdP and NOT a user store — it only gates apps against an upstream provider you already run or rent. Vs Authelia/Tinyauth (proxy SSO / portal), authentik (full IdP), and Dex (federated OIDC IdP that still is not an app-fronting proxy): oauth2-proxy sits in front of apps, talks out to an IdP, and never owns accounts. You still configure the upstream client, cookies/headers, and the protected upstreams.

• NakamaApache-2.0 full game backend — auth, storage, matchmaking, chat

  Free / OSS · Apache-2.0 · 13.5k GitHub stars

  VerdictApache-2.0 game backend. Free OSS single-node path; cluster HA is Enterprise — not the free story.

  CatchVs Colyseus, Gatho, and PartyKit: full social/game server, not a rooms-only kit, not process-per-room WebSockets, not CF Durable Objects. Multi-node HA / cluster management is Nakama Enterprise proprietary — the free path is OSS single-node (or single-process) self-host; clustering is the commercial side. You still run Postgres/Cockroach and own ops.

• RauthyApache-2.0 Rust passkey-forward OIDC+OAuth2 IdP with PAM/NSS

  Free / OSS · Apache-2.0 · 1.4k GitHub stars

  VerdictApache-2.0 Rust IdP. Free forever self-host; tiny RAM, not a free Cloud seat.

  CatchVs Pocket ID (passkey-only OIDC), Keycloak/authentik/ZITADEL/Kanidm/Ory (fuller IAM/CIAM lanes): Rauthy is a self-host Rust IdP with PAM/NSS — not a hosted free-tier IdP and not “enterprise IAM in a box” marketing. You still run the binary, pick Hiqlite vs Postgres, and own TLS/clients/ops.

• mcp-remoteMIT npx stdio↔remote MCP proxy with OAuth support

  Free / OSS · OSS/MIT · 1.6k GitHub stars

  VerdictMIT remote-MCP stdio shim. Use until your client speaks OAuth remote natively.

  CatchVs SuperGateway (bidirectional stdio↔SSE/WS bridge): mcp-remote is the client-side remote+OAuth drop-in, not a capability server and not a full gateway product. Some clients already speak unauth remote MCP — you only need this for OAuth/legacy stdio hosts. Adds a local Node process in the path.

• ComposioFreemium agent toolkits + managed OAuth across 1000+ apps

  Free / OSS · Freemium · 30.7k GitHub stars

  VerdictFreemium agent tool/auth fabric. Great connectors; you rent the OAuth middle.

  CatchVs github-mcp (one official GitHub surface) and raw MCP servers: Composio is a multi-app auth/tool platform — you depend on their connector quality and hosted auth. Free tier exists; production is seat/usage freemium. Not a coding agent and not a browser fleet.

• MCPJamOSS MCP testing, debugging, and evals platform

  Free / OSS · Apache-2.0 · 2.3k GitHub stars

  VerdictApache-2.0 MCP test platform. Use for real-client MCP debugging/evals; watch the proprietary evals carve-out.

  CatchVs MCP Inspector (official MIT debugger): MCPJam is the broader test/eval platform with hosted gravity, not only the reference inspector. Some `/server/services` and evals paths are separately licensed proprietary portions — treat the free OSS inspector path as the bar, not every hosted feature.

• tregMetered tool catalog and team vault for agent integrations

  Free / OSS · Apache-2.0+Terms · 5.9k GitHub stars

  VerdictSelf-host-free tool catalog with a serious license rider. Useful for a team that wants metering and vaulting; stop for legal review before embedding or offering it as a competing service.

  CatchVs Composio and Smithery: treg is the self-hostable tool catalog and team-vault path, not a hosted connector marketplace or MCP registry alone. The Apache-2.0 license has additional terms — no competing hosted, managed, or embedded third-party service without prior written authorization — so it is not a clean “use the code anywhere” Apache grant. The curl|sh installer and credential injection deserve a disposable first run, pinned source, and narrowly scoped secrets.

• FrontMCPApache-2.0 TypeScript-first MCP server framework (decorators, DI, OAuth)

  Free / OSS · Apache-2.0 · 147 GitHub stars

  VerdictApache-2.0 TS MCP server framework when you want decorators/DI/OAuth out of the box — only if Node 24+ is fine and you are building servers, not hosting agents.

  CatchYoung star count. Requires Node.js 24+. Vs FastMCP (Python) / official TS SDK: those are lighter protocol layers; FrontMCP is a batteries-included server framework, not an MCP host or agent runtime.

More with this tag (30)

• Floci — MIT free local AWS cloud API emulator (:4566 LocalStack-shaped)
• InsForge — Apache agent-native backend with MCP self-host
• mold — MIT drop-in Unix linker by the lld author — multi-x faster links for Rust, C and C++ debug builds
• Higress — Apache-2.0 AI and API gateway on Envoy and Istio, with Wasm plugins, model proxying and MCP hosting
• MCP Toolbox for Databases — Apache-2.0 Google MCP server for databases
• Appwrite — BSD-3-Clause backend: auth, database, storage, functions
• Technitium DNS Server — GPL-3.0 self-hosted recursive DNS server
• Apache Casbin — Apache-2.0 authorization library: ACL, RBAC, ABAC
• lldap — GPL-3.0 light LDAP server for simple user management
• Authorizer — Apache-2.0 self-hosted auth server on your own database
• Authgear — Apache-2.0 open alternative to Auth0 and Clerk
• django-allauth — MIT accounts, social login and MFA for Django
• Vouch Proxy — MIT SSO for Nginx via auth_request and OAuth/OIDC
• Nhost — MIT open-source Firebase alternative with Postgres and GraphQL
• Refine — MIT React framework for admin panels and internal tools
• ShopifySharp — MIT .NET library for building Shopify apps
• Hyperswitch Prism — Apache-2.0 stateless library: one payment API for Stripe, Adyen and more
• Parse Server — Apache-2.0 self-hosted backend on Node.js with MongoDB or Postgres
• Django — BSD-3-Clause batteries-included Python web framework: ORM, migrations, admin, auth
• SuperTokens — Apache-2.0 session auth you can self-host with no MAU cap
• Hanko — AGPLv3 passkeys-first auth with a 10k-MAU free Cloud
• Infisical — MIT secrets; Cloud Free forever 5 identities; ee/ needs LICENSE_KEY
• LiteLLM — MIT OpenAI-compatible gateway to 100+ LLMs; Enterprise SSO paid
• Hexclave — MIT clients / AGPLv3 server auth; Cloud Free ≤10k forever
• Clerk — Auth that actually ships with your UI
• Kinde — Hosted auth plus billing, $0 forever, 10,500 MAU, no OSS
• WorkOS — Proprietary AuthKit: first 1M MAUs Free, not OSS
• Descope — Proprietary auth: Free Forever 7500 MAUs / 10 tenants / 3 SSO
• FusionAuth — Source-available CIAM; Community self-host free unlimited users
• Stytch — Auth SaaS with no feature gates; free to 10k MAU + 5 SSO/SCIM