Open-source alternatives to Auth0

The six projects above all show up under “open-source Auth0 alternative”, but they are not interchangeable. After running three of them in production under load (Keycloak in a B2B SaaS, Authentik for an internal admin gateway, SuperTokens in a Next.js side project), the split I keep coming back to is not “which has the most stars” — it is what shape of identity problem you actually have.

The license trap nobody warns you about

Of the six, ZITADEL ships under AGPL-3.0. That license has not bitten the projects I have seen in practice, but if you are planning to embed the identity layer into a closed-source SaaS that customers self-host, AGPL section 13 does trigger — your SaaS users are “interacting with the software over a network”, which forces source disclosure of your modifications to ZITADEL. Keycloak, Authelia, and Kratos under Apache-2.0 do not have that constraint. Authentik and SuperTokens both ship under NOASSERTION on the GitHub repo card, which means the GitHub license detector could not parse a clean SPDX header — in both cases the actual licenses are permissive (Apache-2.0 for the non-ee/ parts of supertokens-core, MIT for the Authentik core), but the SuperTokens repo also contains an ee/ directory under a separate enterprise licence, and Authentik’s enterprise modules are similarly carved out. Audit the exact directories you are pulling in and re-check on every minor bump. This is the kind of thing that does not show up in star counts.

When Keycloak is wrong despite being the obvious pick

Keycloak’s 34k stars are real and the project is healthy. Since v17 the default distribution is Quarkus-based (the WildFly distribution was deprecated and then removed), which lowered startup time and memory footprint meaningfully, but the operational reality is still that you are running a JVM service backed by an external Postgres. A minimum viable production deployment is roughly 2-3 GB RAM per node, three nodes behind a load balancer for HA. If you are migrating from Auth0 because the bill hit $2k/month, Keycloak’s infra is going to put you back around $80-150/month plus the engineer-time to keep the JVM and the realm configuration honest. For B2B SaaS with hundreds of tenant realms and a team that is comfortable running JVM services in production, that is a no-brainer. For a five-person startup doing social login on a Next.js app, it is still overkill — SuperTokens or Kratos will be faster to integrate and cheaper to run.

The Ory split (Kratos vs the rest)

Ory Kratos is the only project in this list that is deliberately headless — there is no login UI. You build the login form in your app and call the Kratos API. This is the right answer if your design team already owns the login flow and you do not want to fight a Keycloak theme. It is the wrong answer if you want the identity provider to also be your login UI out of the box, which is what most people coming from Auth0 expect. Read the first 30 lines of the Kratos quickstart before you commit — the headless model is the project’s deliberate stance, not a missing feature.

What actually shifted in the last 12 months

Authentik landed enterprise SSO connectors that made it competitive with Keycloak on the SAML-heavy enterprise side, which was not true a year ago. SuperTokens shipped self-hosted with a SQLite option, which is a viable single-binary setup for very small deployments. ZITADEL keeps expanding the managed cloud offering, which is fine, but means you should re-confirm that the AGPL self-hosted version is not lagging the managed one on auth methods you need — at the time of this revisit it is not, but the gap is worth checking on every quarterly review.

My actual recommendation

If you have a security engineer and need SAML, OIDC, and federation in one box: Keycloak. If you want headless and own your UI: Kratos. If you want the smallest possible footprint and a familiar dashboard: Authentik. The other three are perfectly good projects but ranked behind these three on the trade-offs I keep hitting in production.