Tag
Oidc tools
11 reviewed tools: 10 free or open source, 1 paid or paid-led.
Order: free and open source first, then hosted products with a real free tier, then paid-led; catalog order inside each group, with quiet or archived repos last. Not a score, and no tool pays for its place.
11 tools
- LogtoMPL-2.0 identity platform with a 50k-MAU free Cloud
Free / OSS · Freemium · 14.7k GitHub stars
VerdictThe MPL-2.0 Auth0-shaped stack. Use it when Clerk MAUs are the product.
CatchCloud Free is for starting out. Passkeys, hiding branding, orgs, MFA, and enterprise SSO live as Pro add-ons. MPL-2.0 is file-level copyleft, not MIT.
- KeycloakApache-2.0 CNCF-incubation Java IAM: OIDC, OAuth, SAML, LDAP
Free / OSS · Apache-2.0 · 37.4k GitHub stars
VerdictApache-2.0 CNCF IdP. Heavy, complete, self-host. Not authentik.
CatchCNCF Java IAM, OIDC+OAuth+SAML+LDAP. Distinct from authentik (MIT-core Python, no hosted hatch, enterprise/ carve-out). You run a JVM and a database. There is no $0 Keycloak Cloud on the project site.
- DexApache-2.0 federated OIDC IdP that owns no user state
Free / OSS · Apache-2.0 · 11.2k GitHub stars
VerdictApache-2.0 OIDC facade. Connectors in, standards out, no user table.
CatchProtocol adapter, not a user directory and not a proxy gate. Distinct from Authelia (reverse-proxy SSO) and from authentik/ZITADEL/Keycloak (they store users). Dex owns no user state. You still need an upstream IdP.
- KanidmMPL-2.0 Rust IdP aiming to replace needing Keycloak
Free / OSS · Apache-2.0 · 5.5k GitHub stars
VerdictMPL-2.0 Rust IdP. Self-host free. Not Keycloak.
CatchRust IdP aiming to replace needing Keycloak — not the Java CNCF suite. Distinct from Keycloak (Apache-2.0 JVM IAM). You still operate the box.
- CasdoorApache-2.0 UI-first IdP; Hosted Free 25k MAU, self-host primary
Free / OSS · Freemium · 14.6k GitHub stars
VerdictApache-2.0 IdP. Self-host primary; Hosted Free 25k MAU.
CatchUI-first IdP — vs Keycloak/authentik/Kanidm/Logto/Hanko/Zitadel. Hosted Free 25k MAU; self-host uncapped. Distinct from Keycloak, authentik, Kanidm, Logto, Hanko, and Zitadel.
- Ory Open SourceApache-2.0 modular Go IAM: Kratos, Hydra, Keto, Oathkeeper
Free / OSS · Apache-2.0 · 13.9k GitHub stars
VerdictApache-2.0 modular Go IAM. Compose pieces; their table still says prototyping.
CatchVs Keycloak: modular Go you compose, not one Java IAM. Ory own compare table still labels Ory Open Source Evaluation and prototyping; FAQ steers prototypes to OSS and scale to OEL/Network. Ory Cloud/Network is not the free path. Not a Dex/Keycloak/Casdoor twin.
- Pocket IDBSD-2-Clause passkey-only OIDC IdP; self-host only
Free / OSS · BSD-2-Clause · 9.7k GitHub stars
VerdictBSD-2-Clause passkey-only OIDC. Self-host; not enterprise IAM.
CatchVs Hanko/Authelia/Keycloak/Ory: passkey-ONLY OIDC IdP (no passwords). Homelab/MCP-scoped, not enterprise IAM. Free path is self-host only.
- TinyauthAGPL-3.0 one-binary proxy auth + Certified OIDC
Free / OSS · AGPL-3.0 · 8.4k GitHub stars
VerdictAGPL one-binary proxy auth + Certified OIDC. Self-host forever.
CatchVs Authelia/Pocket ID: tiny proxy-fronted auth + Certified OIDC in one binary — not Authelia reverse-proxy SSO alone, not passkeys-only Pocket ID. Free path is self-host.
- OAuth2 ProxyMIT CNCF Sandbox reverse-proxy auth gate vs external IdPs
Free / OSS · OSS/MIT · 15.2k GitHub stars
VerdictMIT CNCF reverse-proxy auth gate. Free forever; bring an external IdP — this is not one.
CatchNOT an IdP and NOT a user store — it only gates apps against an upstream provider you already run or rent. Vs Authelia/Tinyauth (proxy SSO / portal), authentik (full IdP), and Dex (federated OIDC IdP that still is not an app-fronting proxy): oauth2-proxy sits in front of apps, talks out to an IdP, and never owns accounts. You still configure the upstream client, cookies/headers, and the protected upstreams.
- RauthyApache-2.0 Rust passkey-forward OIDC+OAuth2 IdP with PAM/NSS
Free / OSS · Apache-2.0 · 1.4k GitHub stars
VerdictApache-2.0 Rust IdP. Free forever self-host; tiny RAM, not a free Cloud seat.
CatchVs Pocket ID (passkey-only OIDC), Keycloak/authentik/ZITADEL/Kanidm/Ory (fuller IAM/CIAM lanes): Rauthy is a self-host Rust IdP with PAM/NSS — not a hosted free-tier IdP and not “enterprise IAM in a box” marketing. You still run the binary, pick Hiqlite vs Postgres, and own TLS/clients/ops.
- FusionAuthSource-available CIAM; Community self-host free unlimited users
Paid-led · Freemium
VerdictFree unlimited self-host CIAM. Not OSS; paid for premium/Cloud.
CatchNOT open source — source-available proprietary CE. Vs Keycloak/ZITADEL/Ory: easier admin UX + flat pricing, but you cannot fork freely like Apache/AGPL IdPs. Premium features and FusionAuth Cloud are paid. Ops burden is yours on CE.
FAQ
- What is the top free pick among Oidc tools?
- Logto leads the Stack Gems list for Oidc tools. Verdict: The MPL-2.0 Auth0-shaped stack. Use it when Clerk MAUs are the product.
- How many Oidc tools does Stack Gems review?
- 11: 10 free or open source, 1 paid or paid-led. Each review has a verdict and an honest Catch; no tool pays for its spot.
- Which Oidc tools can I self-host for free?
- Logto, Keycloak, Dex, Kanidm, Casdoor, Ory Open Source, Pocket ID, Tinyauth and 2 more.
- Which Oidc tools have the most GitHub stars?
- Keycloak (37.4k), OAuth2 Proxy (15.2k), Logto (14.7k), per GitHub on 2026-10-21. Stars measure attention, not fit; read the Catch.
- What is the catch with Logto?
- Cloud Free is for starting out.