Skip to content
c17 .ioJoin list

Best / Auth & identity

Best open-source Auth & identity

The best open-source identity split in the c17.io catalog is Keycloak for a full IdP (OIDC/SAML), Authentik as the MIT-core SSO box (skip authentik/enterprise/), Authelia for forward-auth/MFA in front of apps you already run, and Zitadel or Logto when you want a newer identity platform. App-user login (not workforce SSO) stays on /stacks/auth-without-the-bill. The published IdP combo is /stacks/keycloak-idp.

Open the stackStart on Railway

Ranked picks

  1. 1

    Keycloak

    Apache-2.0 identity provider — the c17 Okta stack.

    When to pick it: Workforce SSO, OIDC, and SAML you host.

    37,403 stars in the catalog

  2. 2

    Authentik

    MIT-core SSO already named on the Okta stack. Skip authentik/enterprise/ if you want OSS-only.

    When to pick it: A slimmer IdP than Keycloak.

    25,983 stars in the catalog

  3. 3

    Authelia

    Apache-2.0 single sign-on portal with MFA for apps behind a reverse proxy.

    When to pick it: Forward-auth in front of self-hosted apps, not a user database.

    29,284 stars in the catalog

  4. 4

    Zitadel

    AGPL identity infrastructure (OIDC, SAML, passkeys).

    When to pick it: A newer IdP if Keycloak feels heavy.

    15,328 stars in the catalog

  5. 5

    Logto

    MPL-2.0 authentication and authorization for SaaS apps (OIDC, SSO, RBAC).

    When to pick it: Product login closer to Auth0 than to Okta workforce.

    14,686 stars in the catalog

How they compare

ToolLicenseSelf-hostBest for
KeycloakApache License 2.0MediumWorkforce SSO, OIDC, and SAML you host.
AuthentikMIT LicenseMediumA slimmer IdP than Keycloak.
AutheliaApache License 2.0MediumForward-auth in front of self-hosted apps, not a user database.
ZitadelGNU Affero General Public License v3.0MediumA newer IdP if Keycloak feels heavy.
LogtoMozilla Public License 2.0MediumProduct login closer to Auth0 than to Okta workforce.

Related pages

FAQ

Okta or Auth0?
Auth0 is Okta's customer-login product and already has /replace/auth0 on SuperTokens. This page is workforce SSO and an IdP you run. That is the stack FAQ.
Keycloak or Authentik?
Keycloak if you want the older, widely-integrated Apache-2.0 IdP. Authentik if you want a slimmer MIT-core box. Pick one.
Are these free?
OSI licenses as listed (Authentik enterprise/ is commercial). You pay hosting. App login without an IdP is SuperTokens/PocketBase/Tinyauth — $0 license at 10,000 / 50,000 / 100,000 MAU. Template users never pay c17.
How do I deploy it?
Open /stacks/keycloak-idp for SSO, or /stacks/auth-without-the-bill for app login. Railway CTAs stay on those pages.

Stack of the Week

Get one stack a week that replaces a SaaS bill.

Sponsor this page