Authentication is the easiest thing to add and the hardest thing to remove. Every query that brings developers here is a direct head-to-head: keycloak vs better auth, better auth vs workos, zitadel vs auth0, ory vs zitadel, authelia alternatives. Nobody is browsing.
Two facts decide most of those matchups: what the licence obliges you to do, and what the bill looks like when you grow.
Scope: this is about authentication and identity providers for software teams. Not consumer identity-theft protection, identity verification, or the video game company.
At a glance
| Product | Model | Best for | Licence | Watch out for |
|---|---|---|---|---|
| Auth0 | Hosted | The established default | Proprietary | Per-MAU cost at scale |
| WorkOS | Hosted | Enterprise SAML and SCIM, fast | Proprietary | Priced for B2B |
| Clerk | Hosted | React and Next.js teams | Proprietary | From $20/month |
| Keycloak | Self-hosted | Full IdP you control | Apache-2.0 | Heavy, Java |
| Zitadel | Self-hosted | Modern self-hosted IdP | AGPL-3.0 | Copyleft reaches network use |
| Ory | Self-hosted | Modular, assemble your own | Apache-2.0 | You assemble it |
| Authelia | Self-hosted | Forward-auth in front of services | Apache-2.0 | 3 CRITICAL this year |
| Better Auth | Library | Auth inside your app | MIT | Young, less proven |
| AWS Cognito | Hosted | Already deep in AWS | Proprietary | Lowest score here |
The licence that bites: AGPL
Zitadel is AGPL-3.0, the single most consequential licence fact on this page and routinely missed by comparisons with an "open source: yes/no" column.
AGPL extends copyleft to software provided over a network, not just software you distribute. Running it as an internal IdP is unremarkable. Embedding it in a product you offer customers, or modifying and exposing it as a service, needs legal advice. The commercial cloud from $100/month exists partly to resolve this.
By contrast Keycloak, Ory and Authelia are Apache-2.0, Better Auth is MIT, Auth.js is ISC. Logto is MPL-2.0, file-level copyleft, so modifications to its own files must be shared but your application is unaffected.
Entry pricing, and why it misleads
| Product | Entry price |
|---|---|
| PropelAuth | From $0.00/month |
| Stytch | From $0.01/month, usage-based |
| Ory | From $0.14/month |
| Clerk | From $20/month |
| Better Auth | From $20/month |
| Logto | From $24/month |
| Kinde | From $25/month |
| Zitadel | From $100/month |
| SuperTokens | From $100/month |
| FusionAuth | From $162/month |
Entry prices are close to meaningless here. What matters is the per-MAU curve past the free tier, and which features sit behind the enterprise gate. SAML, SCIM provisioning and audit logs are the three that force an upgrade, and exactly the three an enterprise customer will demand.
The failure mode is predictable: ship on a free tier, grow, sign a customer who requires SAML, then discover SAML lives on a plan costing several times your current bill.
Self-hosted identity servers
Keycloak
Apache-2.0 · 36,638 stars · 0 advisories · 1,477 dependent repos · 10 integrations · score 65.6
Heavy, Java, and it will do essentially everything an enterprise IdP is expected to do.
Verdictstill the default for teams that want a full identity provider they control.
Keycloak alternatives
keycloak vs better auth is our most common query here, and it compares two architectures rather than two products.
- Keycloak is too heavy then Zitadel (mind the AGPL) or Logto.
- You want a library in your app, not a server then Better Auth or Auth.js.
- You want it hosted then Auth0, WorkOS, Clerk or Kinde.
- You want modular pieces then Ory.
- You are leaving over licensing then note Keycloak is already Apache-2.0, so that is not the issue.
Zitadel
AGPL-3.0 · 14,955 stars · shipped 2026-09-04 · 0 advisories · 12 integrations · from $100/month · score 60.4
Verdicta strong modern IdP. The licence is the decision, not the features.
Ory
Apache-2.0 · 13,872 stars · shipped 2026-03-20 · 2 advisories, 1 recent (HIGH) · from $0.14/month · score 76.4, confidence 0.69
Separate services for identity, permissions and OAuth rather than a monolith.
Verdictthe modularity is either the appeal or the objection. Nothing in between.
Authelia
Apache-2.0 · 28,889 stars · shipped 2026-09-10 · 7 advisories, 3 in the last 12 months (CRITICAL) · 55 integrations, the most here · score 60.0
The only entry with a recent CRITICAL disclosure rate, in software whose entire job is guarding access.
Verdictexcellent as a forward-auth layer. Read the advisories directly before adopting.
Authentik, SuperTokens, Logto
Authentik: 25,393 stars, shipped 2026-09-01, 0 advisories, score 46.2. SuperTokens: 15,295 stars, 0 advisories, from $100/month. Logto: MPL-2.0, 14,513 stars, 20 integrations, from $24/month.
Verdictall credible. Logto is the most approachable of the three.
Hosted providers
Auth0
20 integrations · free tier, 22-day trial · score 88.0, confidence 0.73
Highest score on this page.
Verdictthe established option, priced accordingly. zitadel vs auth0 is usually a build-versus-buy question wearing a product comparison.
WorkOS
27 integrations, the most of any hosted provider · score 72.0, confidence 0.71
Verdictaimed squarely at the "we just signed an enterprise customer and now need SAML and SCIM" problem, which is why it appears so often against self-hosted options.
Descope, Clerk, Kinde, PropelAuth, Frontegg, Stytch, FusionAuth
Descope: 23 integrations, score 84.8. Clerk: from $20/month, score 68.0. Kinde: from $25/month. PropelAuth: from $0.00. Frontegg: free tier. Stytch: usage-based. FusionAuth: from $162/month.
VerdictDescope is the strongest of the newer generation on our evidence.
Better Auth
MIT · 29,896 stars · shipped 2026-09-10 · 0 advisories · 24 integrations · from $20/month · score 65.0, confidence 0.39
A library that lives in your application rather than a server you run.
Verdictthe interesting entry. On the evidence we hold it scores 73.6 against a published 65.0, the largest such gap here, because it is new enough that we have less record of it.
AWS Cognito
10 integrations · usage-based · score 44.8, confidence 0.73
Verdicta real finding rather than a measurement gap. On pricing transparency, integration breadth and developer documentation it measures poorly despite enormous deployment. The AWS integration may still outweigh that.
Method, and what we could not verify
Confidence runs from 0.18 to 0.73.
One figure excluded. We record the latest Keycloak release as 2022-09-27, which is an artefact of a rolling nightly tag rather than a real release. Keycloak ships regularly.
We hold no licence record for Authentik, SuperTokens, Auth0, Descope, WorkOS, Clerk, Kinde, PropelAuth, Frontegg, Stytch, FusionAuth, Firebase Authentication, TrueCaaS or AWS Cognito. For Authentik and SuperTokens, which are open source, that is a gap on our side.
We could not verify per-MAU pricing curves beyond the entry figure, or which features sit behind enterprise gates. Those two determine total cost and are the two vendors publish least clearly.
Category rename recommended. "Auth and Identity Software" pulls consumer identity-theft results and a games company. "Authentication and Identity Providers" would match the audience.
We take no vendor payment for placement.
Evaluate these against your own constraints
Twenty-one products across three architectures. The right one depends on your expected user count, whether you need SAML and SCIM, and whether you can run identity infrastructure.
Sources
Advisory data from advisories.ecosyste.ms, adoption from GitHub, both retrieved 2026-09-11. Pricing independently observed; each product page links the vendor page it was observed from.