auth

Loud Catch: Clerk is a paid auth product with a free tier that evaporates as MAUs grow. You are outsourcing login UI and session logic; customization is the Clerk way or a fight. This is not the OSS auth library.

You are building the UI, handling edge cases, and managing the infrastructure. Provider quirks require debugging.

The all-in-one convenience creates dependency. Complex queries hit performance limits. Self-hosting requires significant operational knowledge.

The library is free; dashboards, audit, and SSO add-ons are the paid wedge. Starter audit retention is 1 day. This is not a hosted IdP — you still own the database and the incident.

SQLite is the database. Concurrent writes and multi-region are not the product. There is no official hosted PocketBase Cloud. You run the binary, you own backups, you own the disk filling up.

Cloud Free is for starting out. Passkeys, hiding branding, orgs, MFA, and enterprise SSO live as Pro add-ons. MPL-2.0 is file-level copyleft, not MIT.

Three processes, not a single library. ee/ is not Apache. Cloud is MAU-metered; MFA and account-linking have 100 USD/month minima on Cloud. Read the carve-out before you assume the whole repo is Apache-2.0.

enterprise/ is not MIT — EE license, paid seats. No hosted hatch: goauthentik.io/pricing says they do not currently provide a hosted version. You run Postgres and the stack.

Split licenses: backend AGPLv3, Elements and frontend SDKs MIT. Cloud Starter Free 10k MAU is the wall — after that you pay. Cloud Console is closed source. AGPL on the API is network copyleft.

Loud: the wall is 100 DAU, not Logto 50k MAU. AGPLv3 is network copyleft — Cloud or self-host, the license is loud. Pro is US$100/Month for 25k DAU. Distinct from Hanko passkeys-first Cloud and authentik no-hosted-hatch.

Not self-host. Kinde branding stays on Free. SMS is 10 included. Pro is $25/mo to uncap MAU and drop branding. Distinct from Polar (Apache MoR, not an IdP) and Clerk (auth UI, no 0.7% billing take-rate on Free).

You run it behind Traefik/Caddy/nginx. Thin proxy SSO, not a full IdP like authentik (flows, LDAP/RADIUS/SAML, enterprise/). No hosted Authelia Cloud. Ops, the user store, and the proxy stay yours.

CNCF Java IAM, OIDC+OAuth+SAML+LDAP. Distinct from authentik (MIT-core Python, no hosted hatch, enterprise/ carve-out). You run a JVM and a database. There is no $0 Keycloak Cloud on the project site.

Rust IdP aiming to replace needing Keycloak — not the Java CNCF suite. Distinct from Keycloak (Apache-2.0 JVM IAM). You still operate the box.

authZ YAML PDP — not authentik/Keycloak/Better Auth authN/IdP. Do not reprint Hub prices; self-host PDP is the free path. Distinct from authentik, Keycloak, and Better Auth.

LOUD: proprietary — not OSS. Vs Clerk/Logto/Kinde/Hanko/Better Auth. Free MAU band is the pitch; paid enterprise features exist — do not invent numbers. Distinct from Clerk, Logto, Kinde, Hanko, and Better Auth.

LOUD: proprietary — not OSS. Free Forever caps are real; above them is paid. Vs Clerk/Logto/Kinde/WorkOS/Hanko/Better Auth. Distinct from Clerk, Logto, Kinde, WorkOS, Hanko, and Better Auth.

UI-first IdP — vs Keycloak/authentik/Kanidm/Logto/Hanko/Zitadel. Hosted Free 25k MAU; self-host uncapped. Distinct from Keycloak, authentik, Kanidm, Logto, Hanko, and Zitadel.

Vs Keycloak: modular Go you compose, not one Java IAM. LOUD: Ory own compare table still labels Ory Open Source Evaluation and prototyping; FAQ steers prototypes to OSS and scale to OEL/Network — print that. Ory Cloud/Network CUT as the free path. Not a Dex/Keycloak/Casdoor twin if the Catch stays modular-compose.

Vs Hanko/Authelia/Keycloak/Ory: passkey-ONLY OIDC IdP (no passwords). Homelab/MCP-scoped, not enterprise IAM. Free path is self-host only.

Vs Authelia/Pocket ID: tiny proxy-fronted auth + Certified OIDC in one binary — not Authelia reverse-proxy SSO alone, not passkeys-only Pocket ID. Free path is self-host.

LOUD: NOT open source — source-available proprietary CE. Vs Keycloak/ZITADEL/Ory: easier admin UX + flat pricing, but you cannot fork freely like Apache/AGPL IdPs. Premium features and FusionAuth Cloud are paid. Ops burden is yours on CE.

Closed SaaS — not Better Auth/Ory self-host. LOUD: SSO/SCIM beyond 5 is $125/connection/mo; brand removal $99/mo; fingerprints $0.005 after 10k. MAU overage metered (no hard cliff). HIPAA/SLA need Enterprise.