What is a good alternative to Auth0?

You use Auth0, or you are pricing it, and something makes you look around: the bill as users grow, a feature on a higher plan, or how much of your app depends on Auth0. Good alternatives exist, and many speak the same standard as Auth0, OpenID Connect, so switching is easier than it looks. Which one fits depends on who should run your sign-in and what it has to do.

Why do teams look for an Auth0 alternative?#

Auth0 is a mature hosted identity service, and teams rarely leave over a missing feature. They leave over cost and control.

• Cost at scale. Auth0 bills by monthly active users (MAU): every non-internal user who signed in that month. Paid plans are priced in MAU tiers, with separate B2C and B2B prices, so the bill grows with your audience. Auth0’s pricing page has the tiers.
• Plan gating. Role management isn’t on the Free plan, and log retention runs from one day on Free to 30 days on Enterprise. Some MFA factors, enterprise connections and organization limits also depend on the plan. For custom domains, see alternatives for Auth0 multiple custom domains.
• Complexity. Tenants, applications, connections, Actions and Organizations each have their own settings, which is a lot for a small team.
• Lock-in. Actions are Node.js functions that run inside Auth0, and user ids use Auth0’s format, like auth0|…. Password hashes aren’t available through the Management API, only through a support case, and not on the Free plan.

What are the alternatives to Auth0?#

The alternatives fall into four groups. Many of them can act as an OpenID Connect (OIDC) provider. OIDC is the identity layer on top of OAuth 2.0 that tells your app who signed in, so an app that only talks OIDC can change providers by changing one URL and two credentials. SAML is an older XML-based standard that companies use for single sign-on (SSO) through their own identity provider.

Hosted, developer-first services#

These services run everything for you, with SDKs, sign-in screens and a dashboard. The services themselves aren’t open source.

FusionAuth sits in between: you can run its Community edition yourself for free or use FusionAuth Cloud, but its core isn’t open source.

Open-source servers you host#

You run these yourself, with a database. The open-source editions have no license fee; you pay in servers and upkeep.

Zitadel, Logto, Ory and SuperTokens also offer hosted versions. authentik doesn’t offer one.

Auth bundled with your platform#

If your app already lives on one platform, its sign-in is the shortest path.

• Firebase Authentication works through the Firebase SDKs or the drop-in FirebaseUI. Upgrading to Google Cloud Identity Platform adds MFA, multi-tenancy, and SAML and OIDC sign-in.
• Supabase Auth issues JWTs that work with Postgres Row Level Security. Its server is open source under MIT, and it can also act as an OAuth 2.1 and OIDC provider.
• Amazon Cognito user pools are an OIDC provider with managed login pages and federation through SAML 2.0, OIDC and social providers.

The trade-off is coupling: if you leave the platform, sign-in moves with it.

Libraries in your own code#

A library isn’t an identity provider. Your app stores the users, renders the pages and sends the emails.

• Auth.js, formerly NextAuth.js, is open source under ISC. It has more than 80 preconfigured providers and accepts any OIDC provider through its issuer setting. The Better Auth team has maintained it since September 2025 and recommends Better Auth for new projects.
• Better Auth is a TypeScript library under MIT that keeps users and sessions in your database. Plugins add passkeys, two-factor authentication, organizations and SSO.

How do you choose an Auth0 alternative?#

Answer these before you compare feature lists.

1. Who runs it? A hosted service patches and scales for you. Self-hosting means a database, upgrades and someone on call, because nobody can sign in while it is down.
2. Which protocols? OIDC covers your own apps. Business customers may ask for SAML, and for SCIM, the standard for creating and removing their accounts automatically.
3. Which sign-in methods? Passwords, passkeys, social logins, magic links, or codes by SMS or an authenticator app.
4. Do you sell to companies? Then you probably need organizations and enterprise connections.
5. How many domains? And must the login page sit on your own domain?
6. How does the bill grow, and how would you leave? Price it at ten times your size, and check for user export, password hashes and a discovery URL.

How do you migrate away from Auth0?#

Moving off Auth0 is mostly about the users and the ids your data points to.

1. Export the users with the Management API’s bulk export job, POST /api/v2/jobs/users-exports, as NDJSON or CSV. The export never includes password hashes.
2. Get the hashes, or plan without them. Hashes come only through a support case, as a PGP-encrypted file, after Auth0 reviews the request. Without them, people set a new password or passkey at their first sign-in.
3. Keep a sub mapping. Auth0 ids look like auth0|… and arrive as sub in tokens, and the new provider issues new ones. Keep your own user id as the key, with both ids stored next to it.
4. Never merge accounts by email unless the new provider verified the address.
5. Move one app at a time, with both systems running until the last one switches.

Migrating users without a new sign-up compares bulk import, lazy migration and account linking.

Where loginos fits#

loginos is a hosted OpenID Connect provider for products that run on many domains. It does fewer things than Auth0, on purpose.

loginos fits when:

• Many domains share one pool of people. Someone who joined on one domain signs in on the others without being asked again. Add domains in the console, from your server, with a verified wildcard, or as your server confirms them. See Domains.
• You want passkeys without WebAuthn code. Passkeys live on loginos.io and work on all your domains. Passwords work too.
• You want a standard you can leave. loginos is plain OIDC with a discovery URL, so leaving means changing an issuer, not rewriting your app.
• You need roles and permissions in every token.
• You have users already. With account linking, each person connects a loginos account to their existing one, and tokens carry your user id as external_id. No password hashes move.
• Cost matters. loginos has no paid plans today, and you can start without a card.

loginos doesn’t fit when you need social logins like “Sign in with Google”, SAML or other enterprise SSO, SMS or authenticator codes, organizations inside one product, self-hosting, or a login page on your own domain. Email addresses aren’t verified yet either: email_verified is false, and loginos sends no email.

To try it next to Auth0, create an account, add a platform in the developer console, and point your OIDC library at https://loginos.io/.well-known/openid-configuration. The quickstart has complete examples. Then add a “Link loginos” button to your account settings, so people who use Auth0 today can connect a loginos account.

{  "sub": "9b1f6c2e-…",  "preferred_username": "jane",  "roles": [    "member"  ]}

Frequently asked questions#

Is there a free alternative to Auth0?#

Yes. Open-source servers like Keycloak, Zitadel, authentik and Ory have no license fee, though you pay for servers and upkeep. Hosted services, Auth0 included, have free tiers with limits, and loginos has no paid plans today. See free OpenID Connect providers.

Is Keycloak a good replacement for Auth0?#

It can be, if you are ready to run it. Keycloak is open source under Apache 2.0 and covers OIDC, OAuth 2.0, SAML 2.0, social login, identity brokering and LDAP. You host, upgrade and secure it yourself. See simpler alternatives to Keycloak.

Can I export password hashes from Auth0?#

Only through a support case. Auth0 prepares a PGP-encrypted file after you send your public key, a written authorization and a signed acknowledgment, and it reviews each request. The export isn’t available on the Free plan, and the bulk user export never includes hashes.

Which Auth0 alternatives support SAML?#

WorkOS, Stytch, Descope and Clerk’s paid plans offer SAML single sign-on. Among open-source servers, Keycloak, Zitadel, authentik and Logto support SAML. Firebase gets it through Identity Platform, and Cognito user pools accept SAML 2.0 identity providers. loginos doesn’t support SAML.