# What is a good alternative to Auth0?

> Good Auth0 alternatives include hosted services like Clerk, WorkOS AuthKit, Stytch, Descope and Kinde, and open-source servers you run yourself, like Keycloak, Zitadel, authentik, Ory and Logto. Firebase, Supabase and Amazon Cognito bundle sign-in with their platforms, and Auth.js or Better Auth keep it in your code. Choose by who runs it and how you would leave. loginos fits products on many domains.

You use Auth0, or you are pricing it, and something makes you look around: the bill as users grow, a feature on a higher plan, or how much of your app depends on Auth0. Good alternatives exist, and many speak the same standard as Auth0, OpenID Connect, so switching is easier than it looks. Which one fits depends on who should run your sign-in and what it has to do.

## Why do teams look for an Auth0 alternative?

Auth0 is a mature hosted identity service, and teams rarely leave over a missing feature. They leave over cost and control.

- **Cost at scale.** Auth0 bills by monthly active users (MAU): every non-internal user who signed in that month. Paid plans are priced in MAU tiers, with separate B2C and B2B prices, so the bill grows with your audience. [Auth0’s pricing page](https://auth0.com/pricing) has the tiers.
- **Plan gating.** Role management isn’t on the Free plan, and log retention runs from one day on Free to 30 days on Enterprise. Some MFA factors, enterprise connections and organization limits also depend on the plan. For custom domains, see [alternatives for Auth0 multiple custom domains](https://loginos.io/answers/auth0-multiple-custom-domains-alternatives.md).
- **Complexity.** Tenants, applications, connections, Actions and Organizations each have their own settings, which is a lot for a small team.
- **Lock-in.** Actions are Node.js functions that run inside Auth0, and user ids use Auth0’s format, like `auth0|…`. Password hashes aren’t available through the Management API, only through a support case, and not on the Free plan.

## What are the alternatives to Auth0?

The alternatives fall into four groups. Many of them can act as an OpenID Connect (OIDC) provider. OIDC is the identity layer on top of OAuth 2.0 that tells your app who signed in, so an app that only talks OIDC can change providers by changing one URL and two credentials. SAML is an older XML-based standard that companies use for single sign-on (SSO) through their own identity provider.

### Hosted, developer-first services

These services run everything for you, with SDKs, sign-in screens and a dashboard. The services themselves aren’t open source.

| Service | Protocols | Standout feature |
| --- | --- | --- |
| Clerk | Its own SDKs; can also act as an OAuth 2.0 and OIDC provider | Prebuilt components like `<SignIn />` and `<UserButton />` |
| WorkOS AuthKit | Enterprise SSO over SAML or OIDC, directory sync over SCIM | A hosted login box with SSO, MFA and role-based access |
| Stytch, part of Twilio since November 2025 | APIs and SDKs; SAML and OIDC SSO | Device intelligence against credential stuffing |
| Descope | SDKs; SAML or OIDC SSO per tenant | Descope Flows, a visual builder for sign-in flows |
| Kinde | OAuth 2.0 and OIDC | Sign-in, feature flags and billing in one product |

FusionAuth sits in between: you can run its Community edition yourself for free or use FusionAuth Cloud, but its core isn’t open source.

### Open-source servers you host

You run these yourself, with a database. The open-source editions have no license fee; you pay in servers and upkeep.

| Project | License | Protocols | Standout feature |
| --- | --- | --- | --- |
| Keycloak | Apache 2.0 | OIDC, OAuth 2.0, SAML 2.0 | Identity brokering and LDAP or Active Directory; a CNCF incubating project |
| Zitadel | AGPL-3.0 | OIDC (certified), SAML 2.0, SCIM 2.0 | Organizations for B2B products |
| authentik | MIT, enterprise features separate | OAuth 2.0 and OIDC, SAML, LDAP, RADIUS | A proxy provider for apps without OIDC, SAML or LDAP |
| Ory (Kratos and Hydra) | Apache 2.0 | OAuth 2.0 and OIDC; Hydra is OpenID Certified | Headless APIs: you bring the UI |
| Logto | MPL-2.0 | OIDC, OAuth 2.1, SAML | Prebuilt sign-in flows and organizations |
| SuperTokens | Apache 2.0 core, some features separate | Its own SDKs and sessions | Prebuilt login UI on a route of your own site |

Zitadel, Logto, Ory and SuperTokens also offer hosted versions. authentik doesn’t offer one.

### Auth bundled with your platform

If your app already lives on one platform, its sign-in is the shortest path.

- **Firebase Authentication** works through the Firebase SDKs or the drop-in FirebaseUI. Upgrading to Google Cloud Identity Platform adds MFA, multi-tenancy, and SAML and OIDC sign-in.
- **Supabase Auth** issues JWTs that work with Postgres Row Level Security. Its server is open source under MIT, and it can also act as an OAuth 2.1 and OIDC provider.
- **Amazon Cognito** user pools are an OIDC provider with managed login pages and federation through SAML 2.0, OIDC and social providers.

The trade-off is coupling: if you leave the platform, sign-in moves with it.

### Libraries in your own code

A library isn’t an identity provider. Your app stores the users, renders the pages and sends the emails.

- **Auth.js**, formerly NextAuth.js, is open source under ISC. It has more than 80 preconfigured providers and accepts any OIDC provider through its `issuer` setting. The Better Auth team has maintained it since September 2025 and recommends Better Auth for new projects.
- **Better Auth** is a TypeScript library under MIT that keeps users and sessions in your database. Plugins add passkeys, two-factor authentication, organizations and SSO.

## How do you choose an Auth0 alternative?

Answer these before you compare feature lists.

1. **Who runs it?** A hosted service patches and scales for you. Self-hosting means a database, upgrades and someone on call, because nobody can sign in while it is down.
2. **Which protocols?** OIDC covers your own apps. Business customers may ask for SAML, and for SCIM, the standard for creating and removing their accounts automatically.
3. **Which sign-in methods?** Passwords, passkeys, social logins, magic links, or codes by SMS or an authenticator app.
4. **Do you sell to companies?** Then you probably need organizations and enterprise connections.
5. **How many domains?** And must the login page sit on your own domain?
6. **How does the bill grow, and how would you leave?** Price it at ten times your size, and check for user export, password hashes and a discovery URL.

## How do you migrate away from Auth0?

Moving off Auth0 is mostly about the users and the ids your data points to.

1. **Export the users** with the Management API’s bulk export job, `POST /api/v2/jobs/users-exports`, as NDJSON or CSV. The export never includes password hashes.
2. **Get the hashes, or plan without them.** Hashes come only through a support case, as a PGP-encrypted file, after Auth0 reviews the request. Without them, people set a new password or passkey at their first sign-in.
3. **Keep a `sub` mapping.** Auth0 ids look like `auth0|…` and arrive as `sub` in tokens, and the new provider issues new ones. Keep your own user id as the key, with both ids stored next to it.
4. **Never merge accounts by email** unless the new provider verified the address.
5. **Move one app at a time**, with both systems running until the last one switches.

[Migrating users without a new sign-up](https://loginos.io/answers/migrate-users-without-new-signup.md) compares bulk import, lazy migration and account linking.

## Where loginos fits

loginos is a hosted OpenID Connect provider for products that run on many domains. It does fewer things than Auth0, on purpose.

**loginos fits when:**

- **Many domains share one pool of people.** Someone who joined on one domain signs in on the others without being asked again. Add domains in the console, from your server, with a verified wildcard, or as your server confirms them. See [Domains](https://loginos.io/docs/domains.md).
- **You want passkeys without WebAuthn code.** Passkeys live on loginos.io and work on all your domains. Passwords work too.
- **You want a standard you can leave.** loginos is plain OIDC with a discovery URL, so leaving means changing an issuer, not rewriting your app.
- **You need roles and permissions** in every token.
- **You have users already.** With [account linking](https://loginos.io/docs/link-accounts.md), each person connects a loginos account to their existing one, and tokens carry your user id as `external_id`. No password hashes move.
- **Cost matters.** loginos has no paid plans today, and you can start without a card.

**loginos doesn’t fit when you need** social logins like “Sign in with Google”, SAML or other enterprise SSO, SMS or authenticator codes, organizations inside one product, self-hosting, or a login page on your own domain. Email addresses aren’t verified yet either: `email_verified` is false, and loginos sends no email.

To try it next to Auth0, [create an account](https://loginos.io/register), add a platform in the [developer console](https://loginos.io/developer), and point your OIDC library at `https://loginos.io/.well-known/openid-configuration`. The [quickstart](https://loginos.io/docs/quickstart.md) has complete examples. Then add a “Link loginos” button to your account settings, so people who use Auth0 today can connect a loginos account.

## Frequently asked questions

### Is there a free alternative to Auth0?

Yes. Open-source servers like Keycloak, Zitadel, authentik and Ory have no license fee, though you pay for servers and upkeep. Hosted services, Auth0 included, have free tiers with limits, and loginos has no paid plans today. See [free OpenID Connect providers](https://loginos.io/answers/free-openid-connect-provider.md).

### Is Keycloak a good replacement for Auth0?

It can be, if you are ready to run it. Keycloak is open source under Apache 2.0 and covers OIDC, OAuth 2.0, SAML 2.0, social login, identity brokering and LDAP. You host, upgrade and secure it yourself. See [simpler alternatives to Keycloak](https://loginos.io/answers/keycloak-alternatives.md).

### Can I export password hashes from Auth0?

Only through a support case. Auth0 prepares a PGP-encrypted file after you send your public key, a written authorization and a signed acknowledgment, and it reviews each request. The export isn’t available on the Free plan, and the bulk user export never includes hashes.

### Which Auth0 alternatives support SAML?

WorkOS, Stytch, Descope and Clerk’s paid plans offer SAML single sign-on. Among open-source servers, Keycloak, Zitadel, authentik and Logto support SAML. Firebase gets it through Identity Platform, and Cognito user pools accept SAML 2.0 identity providers. loginos doesn’t support SAML.

---

Updated 2026-10-14. Web page: https://loginos.io/answers/auth0-alternatives