Logo
Deploy Now

SaaS Alternative

AWS Cognito Auth0 Clerk Okta

Categories

Self-Hosted Authentication Identity Management SSO TypeScript IAM OIDC RBAC

Stars

14,407

Forks

1,172

Watchers

112

Developer links

Last Updated: 08-21-2026 12:20 PM (UTC)

Logto

With over 14,000 GitHub stars, 1 million managed identities on Logto Cloud, and continuous releases through version 1.42.0 in July 2026, Logto has emerged as the most credible open-source alternative to Auth0, Clerk, and AWS Cognito by packaging OIDC, OAuth 2.1, enterprise SSO, multi-tenancy, and RBAC into a single MPL-2.0 codebase that self-hosts for free with no per-MAU pricing surprises. Every Logto tenant operates as a fully compliant OpenID Provider supporting PKCE-only public clients, DPoP token binding, and RFC 9068 JWT access tokens. Pre-built sign-in flows handle email, phone, social login via Google, Facebook, Azure AD, and dozens of connectors, passkey authentication, and multi-factor verification through TOTP and WebAuthn. Organizations enable first-class multi-tenancy where users belong to multiple tenants with per-organization RBAC scopes on API resources. Enterprise SSO connects to Okta, Entra ID, and any SAML or OIDC identity provider. SDKs for over 30 frameworks including React, Next.js, Angular, Vue, Flutter, Go, and Python integrate authentication into SPAs, web apps, mobile apps, APIs, machine-to-machine, and CLI tools. The admin console provides user management, audit logs, webhook event subscriptions, and custom domain configuration. Personal Access Tokens and token exchange support AI agent architectures and MCP server authentication. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MPL-2.0 licensed.

Logto
Logto
Logto
Logto
Logto

Benefits

  • Complete OIDC and OAuth 2.1 Provider
  • Every tenant is a fully compliant OpenID Provider with PKCE, DPoP token binding, RFC 9068 access tokens, and SAML support — no protocol pain or enterprise add-ons.
  • First-Class Multi-Tenancy with RBAC
  • Organizations enable users to belong to multiple tenants with per-organization role-based access control scopes on API resources built into the data model natively.
  • 30+ Framework SDKs
  • Pre-built SDKs for React, Next.js, Angular, Vue, Flutter, Go, Python, and more integrate authentication into SPAs, mobile apps, APIs, and machine-to-machine workflows.
  • No Per-MAU Pricing Surprises
  • Self-host for free under MPL-2.0 with unlimited monthly active users, eliminating the per-identity billing that makes Auth0 and Cognito expensive at scale.

Features

  • Pre-Built Sign-In Flows
  • Customizable sign-in UI handles email, phone, social login, passkey authentication, and multi-factor verification through TOTP and WebAuthn out of the box.
  • Enterprise SSO Integration
  • Connect to Okta, Entra ID, and any SAML or OIDC identity provider for enterprise single sign-on with automatic user provisioning and attribute mapping.
  • Social Login Connectors
  • Dozens of pre-built connectors for Google, Facebook, GitHub, Apple, Azure AD, and other identity providers with custom connector extensibility for additional sources.
  • Admin Console and Audit Logs
  • Web-based admin console provides user management, application configuration, webhook event subscriptions, audit logging, and custom domain configuration.
  • AI Agent Authentication
  • Personal Access Tokens, token exchange, and MCP server authentication support secure identity delegation for AI agent architectures and automated workflows.