Public APIs
All posts

Best Auth0 Alternatives in 2026, Ranked

Quick answer: Clerk is the easiest managed replacement, WorkOS AuthKit has by far the largest free tier at 1,000,000 monthly active users, and Keycloak is still the self-hosted standard. Check what you are leaving first: Auth0 gives 25,000 monthly active users free, which is more than Stytch, Kinde or Descope include.

Most "Auth0 alternatives" lists are published by companies selling one of the alternatives. This one is not: we run a directory of public APIs and list Auth0 alongside its competitors. Every price, allowance and repository figure below was read from the vendor's own pricing page or from GitHub on 18 September 2026.

Why do developers look for an Auth0 alternative?

Not because of the free tier. Auth0's free plan covers 25,000 monthly active users, which is one of the more generous allowances in this market.

It is what happens on the other side of it. Auth0 today lists Essentials from $35 per month and Professional from $240 per month, scaling per monthly active user from there, and features are bundled by plan rather than bought individually. Needing one capability, such as more enterprise connections or a second custom domain, can move you a whole tier.

Why the free tiers do not compare

This is the part every listicle gets wrong. These plans are not measured in the same unit, so ranking them by the headline number is meaningless.

| Provider | Free allowance | What the unit actually counts | |---|---|---| | WorkOS AuthKit | 1,000,000 MAU | Any user action in the calendar month. SSO, Directory Sync and SIEM are billed separately | | Clerk (Hobby) | 50,000 MRU | Retained users only. Someone who signs up and never returns is never counted | | Logto | 50,000 MAU | Paid plans bill access tokens issued, not users | | Supabase Auth | 50,000 MAU | 100,000 on the Pro plan, then $0.00325 per user | | Auth0 | 25,000 MAU | Monthly active users, the plain definition | | Kinde | 10,500 MAU | Users you bill more than $4 a month through Kinde are not counted | | Stytch | 10,000 MAU | Plus 5 SSO or SCIM connections and 1,000 M2M tokens | | AWS Cognito | 10,000 MAU | Accounts created after 22 November 2024. Older accounts keep 50,000 | | Descope | 7,500 MAU | Also capped at 10 tenants and 3 SSO connections | | FusionAuth Community | Unlimited | Self-hosted only, community support |

Four different billing units in one table: active users, retained users, access tokens, and connections metered beside users. Clerk's model is the one most worth understanding, because a retained user is someone who came back at least a day after signing up, so a signup spike costs nothing.

What are the best Auth0 alternatives?

Ranked for a team that has outgrown Auth0's free plan and does not want to run identity infrastructure forever.

  1. Clerk. The smoothest managed replacement for a React or Next.js product, with prebuilt components rather than a hosted login page you theme. Free to 50,000 monthly retained users, then $25 a month with published overage rates. It is in our directory as Clerk.
  2. WorkOS AuthKit. The largest free allowance in the market at 1,000,000 monthly active users, including email and password, social OAuth, MFA and passkeys. The business model is enterprise SSO and Directory Sync sold separately, so it fits B2B products that will eventually sell to companies with an identity team.
  3. Logto. Open source core with a managed cloud, 50,000 free monthly active users, and paid plans billed on access tokens rather than per user. The best pick if dormant accounts are what makes your Auth0 bill irritating.
  4. Supabase Auth. Free to 50,000 monthly active users and effectively free if you are already on Supabase Postgres, because your users are rows in your own database. MIT licensed and self-hostable.
  5. Keycloak. The self-hosted standard, backed by Red Hat, 36,842 stars and commits landing today. Full OIDC and SAML, no per-user cost, and a real operational burden: you own the upgrades, the database and the availability.
  6. Zitadel. The modern self-hostable option, AGPL-3.0, with multi-tenancy and organisations built into the data model instead of bolted on. Good when your product is B2B from day one.
  7. authentik. The pick when identity has to cover more than your own app: LDAP, SAML and proxy authentication for internal services alongside standard OIDC. Open core, with an MIT base and a separately licensed enterprise directory.
  8. Better Auth. Not a service at all. A TypeScript library that puts sessions, accounts and social providers in your own database, with 29,997 stars and a commit yesterday. Zero identity bill, and you own every migration and every breach question.
  9. Stytch. Strongest on passwordless, passkeys and fraud prevention, and one of eight identity providers in our authentication and authorization category. The free tier is 10,000 monthly active users, so it is a feature move rather than a cost move.
  10. Kinde. Billing and subscriptions sit next to authentication, and users you already charge through Kinde do not count toward the 10,500 free monthly active users. Sensible for a small SaaS that wants one vendor for both.

Which self-hosted options are actually maintained?

Star counts tell you how many people recommended something once. Commit dates tell you whether it still ships. Read live from GitHub today:

| Project | Stars | Last push | Licence | |---|---|---|---| | Keycloak | 36,842 | 2026-09-18 | Apache-2.0 | | Better Auth | 29,997 | 2026-09-17 | MIT | | Authelia | 29,009 | 2026-09-18 | Apache-2.0 | | authentik | 25,615 | 2026-09-18 | MIT core, enterprise directory | | Ory Hydra | 17,547 | 2026-07-29 | Apache-2.0 | | SuperTokens | 15,312 | 2026-09-14 | Apache-2.0 core, ee directory | | Zitadel | 15,045 | 2026-09-18 | AGPL-3.0 | | Logto | 14,592 | 2026-09-18 | MPL-2.0 | | Casdoor | 14,424 | 2026-09-17 | Apache-2.0 | | Ory Kratos | 13,880 | 2026-07-29 | Apache-2.0 | | Hanko | 9,032 | 2026-09-18 | AGPL-3.0 core | | Supabase Auth | 2,565 | 2026-09-18 | MIT |

Two things fall out of that. Ory's Kratos and Hydra were both last pushed on 29 July 2026, seven weeks ago and by a wide margin the quietest projects here, which is worth knowing before building an API-first identity stack on them. And three of the twelve are open core rather than open source: authentik, SuperTokens and Hanko each keep part of the tree under a separate enterprise licence, so read the LICENSE file before assuming self-hosting is unconditional.

Authelia is listed because self-hosters keep finding it, but it solves a different problem: it authenticates traffic in front of services behind a reverse proxy rather than acting as your application's identity provider.

What our directory shows about machine-to-machine pricing

Several providers above meter machine-to-machine tokens separately from users: Stytch includes 1,000, Logto bills access tokens as its primary unit, and Cognito charges for every M2M token request with no free allowance.

That line matters less than the pricing pages imply. Of the 1,555 public APIs published in our directory, 784 authenticate with a static API key, 614 need no credential at all, and only 150 support OAuth. If your product mostly calls the sort of API in our development category, you are storing keys rather than exchanging client credentials, and the M2M meter stays near zero.

Which one should you pick?

| If this is you | Pick | |---|---| | React or Next.js product, want it done this afternoon | Clerk | | Expect to sell to enterprises with SSO requirements | WorkOS AuthKit | | Large dormant user base, bill driven by inactive accounts | Logto | | Already running Supabase Postgres | Supabase Auth | | No per-user cost at any scale, have ops capacity | Keycloak or Zitadel | | Want auth inside your own codebase and database | Better Auth | | Passkeys and fraud signals are the actual requirement | Stytch | | Auth0 free tier still fits and nothing hurts | Stay. 25,000 MAU is a good deal |

Frequently asked questions

Is there a free alternative to Auth0?

Several, and three of them are more generous than Auth0's own 25,000 monthly active users: WorkOS AuthKit at 1,000,000, and Clerk, Logto and Supabase Auth at 50,000. Self-hosting Keycloak, Zitadel or FusionAuth Community removes the per-user cost entirely, in exchange for running the service yourself.

What is the best open source Auth0 alternative?

Keycloak if you want the mature, widely deployed option with SAML and OIDC and do not mind operating a JVM service and a database. Zitadel if you are starting fresh, want multi-tenancy in the data model, and can live with AGPL-3.0. Both were shipping commits the day this was written.

Is Auth0 expensive?

Only after the free plan. Auth0's own pricing page today lists Essentials from $35 per month and Professional from $240 per month, and both scale per monthly active user above their included allowance. The common complaint is not the rate, it is that a single feature requirement can move you between tiers.

Can I self-host Auth0?

No. Auth0 is a managed service, and there is no community edition to run on your own infrastructure. If self-hosting is the requirement, the realistic shortlist is Keycloak, Zitadel, authentik, Logto or FusionAuth Community.

Will switching force a password reset for my users?

Not necessarily. Auth0 can export password hashes through a support request, and providers including Logto, Keycloak and Supabase Auth can import bcrypt hashes directly, so existing passwords keep working. Plan for the accounts that used social login separately: those are re-linked by identity provider and email, not migrated as credentials.