Is there a free OpenID Connect provider I can use for my app?

You want people to sign in to your app through a standard protocol instead of a vendor SDK, and you don’t want to pay for it yet. Free OpenID Connect providers come in three forms: open-source servers you run yourself, free tiers of hosted services, and mock servers for development. Each costs something other than money, and the same client code works with all of them.

What is an OpenID Connect provider?#

An OpenID Connect provider, also called an OpenID Provider (OP), is a server that signs people in and tells your app who they are in a signed ID token. OpenID Connect (OIDC) is the identity layer on top of OAuth 2.0. Your app sends the browser to the provider, gets a one-time code back, and exchanges it for tokens on the server.

Every OIDC provider can publish a discovery document at /.well-known/openid-configuration, as defined by OpenID Connect Discovery. The document lists the provider’s endpoints, signing keys and features, so a standard library configures itself from one URL. That is what makes providers interchangeable.

Which open-source OpenID Connect providers can you host for free?#

These projects are free to download and run. They range from a full identity server to a thin layer in front of accounts you already have.

Other open-source options include Logto (MPL-2.0) with prebuilt sign-in flows, Kanidm (MPL-2.0), and Pocket ID (BSD-2-Clause), an OpenID Certified provider that signs people in with passkeys only.

What does a free self-hosted provider cost?#

The software is free, but running it isn’t. A self-hosted OIDC provider needs:

• A server or container platform, a database, TLS certificates and backups.
• Upgrades and security patches. An identity server is an attractive target, so falling behind on releases is a real risk.
• Email delivery for verification codes and password resets.
• Monitoring and someone on call. When the provider is down, nobody can sign in to any app that uses it.

For a side project, that may be fine. For a business, it becomes part of somebody’s job.

Which hosted OpenID Connect providers have a free tier?#

Most hosted identity services have a free tier. The limits differ by provider: monthly active users, number of apps, custom domains, MFA, log retention and support. Free tiers change, so check the current pricing page before you build on one.

A hosted free tier saves you the operations work, but your users live in the vendor’s system, and moving them later takes planning. Auth0 alternatives compares hosted services in more depth.

Can you run a mock OpenID Connect server for testing?#

Yes. A mock server acts like a provider on your machine and signs real tokens, but it lets anyone sign in as anyone. Use one in development and automated tests, never in production.

• navikt/mock-oauth2-server (MIT) runs in Docker and shows a login page where you type any username and claims. Its discovery URL is http://localhost:8080/default/.well-known/openid-configuration.
• oauth2-mock-server (MIT, on npm) starts from your test code. Its /authorize endpoint redirects straight back without a login page, which suits automated tests.
• Keycloak in development mode (start-dev) gives you a full provider on your machine when a mock is too simple.

docker run -p 8080:8080 ghcr.io/navikt/mock-oauth2-server:6.0.7

How do you connect your app to any OpenID Connect provider?#

Use a certified OIDC library and give it the provider’s address. The library reads the discovery document, adds state and PKCE to the redirect, and checks the ID token. PKCE (Proof Key for Code Exchange) stops a stolen code from being used. The examples point at loginos; to switch providers, change the address and the credentials.

import * as client from "openid-client";

// Reads https://loginos.io/.well-known/openid-configuration.
const config = await client.discovery(
  new URL("https://loginos.io"),
  process.env.LOGINOS_APP_KEY,
  process.env.LOGINOS_APP_SECRET,
);
const callbackPath = "/api/auth/login/single/callback";

app.get("/login", async (req, res) => {
  const verifier = client.randomPKCECodeVerifier();
  const state = client.randomState();
  res.cookie("oidc", `${state}.${verifier}`, { httpOnly: true, secure: true, sameSite: "lax", maxAge: 600_000 });
  const url = client.buildAuthorizationUrl(config, {
    redirect_uri: `https://${req.get("host")}${callbackPath}`,
    scope: "openid profile email",
    code_challenge: await client.calculatePKCECodeChallenge(verifier),
    code_challenge_method: "S256",
    state,
  });
  res.redirect(url.href);
});

app.get(callbackPath, async (req, res) => {
  const [state, verifier] = (req.cookies.oidc ?? "").split(".");
  try {
    const tokens = await client.authorizationCodeGrant(
      config,
      new URL(req.originalUrl, `https://${req.get("host")}`),
      { pkceCodeVerifier: verifier, expectedState: state },
    );
    req.session.user = tokens.claims(); // sub, name, email…
    res.redirect("/");
  } catch {
    res.status(401).send("Sign-in failed.");
  }
});

openid-client is OpenID Certified for the Basic, FAPI 1.0 and FAPI 2.0 relying party profiles. Authlib’s Flask client keeps state, the nonce and the PKCE verifier in the session for you.

Where loginos fits#

loginos is a hosted OpenID Connect provider at loginos.io. There is no server for you to run, loginos has no paid plans today, and you can start without a card.

loginos fits when:

• You want standard OIDC. Discovery is at https://loginos.io/.well-known/openid-configuration, with the authorization code flow, PKCE (S256) and RS256 ID tokens, so the code above works unchanged. The OIDC reference lists every endpoint, claim and error.
• Your app runs on several domains. All domains of a platform share one pool of people, with no limit on how many you add. See single sign-on across domains.
• You want passkeys without building them. Passkeys live on loginos.io and work on all your domains, and passwords still work.
• You need roles. Roles and permissions come in every token.

loginos doesn’t fit when you need self-hosting or open source, social logins, SAML, SMS or authenticator codes, organizations inside one product, or a login page on your own domain. Email addresses aren’t verified yet (email_verified is false), and there are no refresh tokens: access and ID tokens last one hour, and your app keeps its own session after sign-in.

To start, create an account, add a platform with your first domain in the developer console, and copy the app secret when it is shown. Put both credentials in your server’s environment, and use the code above with the callback https://<your domain>/api/auth/login/single/callback. The quickstart has complete examples for Next.js, Express and PHP.

Frequently asked questions#

Is Keycloak free?#

Yes. Keycloak is open source under the Apache 2.0 license and costs nothing to download and run. You still pay for the servers, and for the time to upgrade, back up and secure it. If running it is more than you want, see simpler alternatives to Keycloak.

What is the difference between OpenID Connect and OAuth 2.0?#

OAuth 2.0 lets an app get an access token to call an API on someone’s behalf, but it doesn’t say who that person is. OpenID Connect adds an ID token, standard claims like sub, name and email, a userinfo endpoint and discovery, so your app learns who signed in.

Can I use Google as my OpenID Connect provider?#

Yes, for people with Google accounts. Google’s OpenID Connect endpoint is OpenID Certified, with discovery at https://accounts.google.com/.well-known/openid-configuration. It only signs in people who have a Google account, so most apps offer it next to other ways to sign in.

Does a hosted provider lock me in?#

Less than you might think, if it speaks standard OIDC. Your app depends on the discovery URL, the token endpoint and the ID token, so switching providers is mostly configuration. The hard part is the accounts: passwords, passkeys and user ids. Keep your own user id as the key, and store each provider’s sub next to it.