# Best open source SSO and identity providers > The best open source SSO and identity provider is Keycloak, with 37,156 GitHub stars, the Apache-2.0 license and a Docker image; Authelia and authentik are strong alternatives. This page also breaks the picks down by team size and use: Keycloak leads for startups and enterprise; authentik for small business. The overall ranking weighs GitHub stars, commits in the last year, Docker images, open-source licenses and recent commits across the 12 apps in the identity & SSO category of the appsgit catalog. ## Key facts | Fact | Value | |---|---| | Question | What is the best open source SSO and identity provider? | | Picks | 25 | | Top pick | Keycloak (37,156 stars) | | Data as of | Oct 7, 2026 | | Canonical URL | https://appsgit.com/best/open-source-identity-providers | ## Top picks 10 of the 12 apps in the identity & SSO category, ranked on GitHub stars, commits in the last year, Docker images, open-source licenses and recent commits. - [Keycloak](https://appsgit.com/apps/keycloak) (37,156 stars, Apache-2.0, Java, Docker): Keycloak has 37,156 GitHub stars, uses the Apache-2.0 license, ships a Docker image and had 3,157 commits in the last year; it replaces Auth0 and Okta. - [Authelia](https://appsgit.com/apps/authelia) (29,182 stars, Apache-2.0, Go, Docker): Authelia has 29,182 GitHub stars, uses the Apache-2.0 license, ships a Docker image and had 2,474 commits in the last year; it replaces Auth0 and Okta. - [authentik](https://appsgit.com/apps/authentik) (25,859 stars, MIT, Python, Docker): authentik has 25,859 GitHub stars, uses the MIT license, ships a Docker image and had 5,375 commits in the last year; it replaces Auth0 and Okta. - [Logto](https://appsgit.com/apps/logto) (14,652 stars, MPL-2.0, TypeScript, Docker): Logto has 14,652 GitHub stars, uses the MPL-2.0 license, ships a Docker image and had 1,322 commits in the last year; it replaces Auth0. - [Casdoor](https://appsgit.com/apps/casdoor) (14,515 stars, Apache-2.0, Go, Docker): Casdoor has 14,515 GitHub stars, uses the Apache-2.0 license, ships a Docker image and had 1,090 commits in the last year. - [ZITADEL](https://appsgit.com/apps/zitadel) (15,213 stars, AGPL-3.0, Go, Docker): ZITADEL has 15,213 GitHub stars, uses the AGPL-3.0 license, ships a Docker image and had 656 commits in the last year; it replaces Auth0 and Okta. - [SuperTokens](https://appsgit.com/apps/supertokens) (15,335 stars, Apache-2.0, Java, Docker): SuperTokens has 15,335 GitHub stars, uses the Apache-2.0 license, ships a Docker image and had 560 commits in the last year. - [Ory Kratos](https://appsgit.com/apps/ory-kratos) (13,909 stars, Apache-2.0, Go, Docker): Ory Kratos has 13,909 GitHub stars, uses the Apache-2.0 license, ships a Docker image and had 408 commits in the last year; it replaces Auth0. - [Dex](https://appsgit.com/apps/dex) (11,157 stars, Apache-2.0, Go, Docker): Dex has 11,157 GitHub stars, uses the Apache-2.0 license, ships a Docker image and had 605 commits in the last year. - [Pocket ID](https://appsgit.com/apps/pocket-id) (9,402 stars, BSD-2-Clause, Go, Docker): Pocket ID has 9,402 GitHub stars, uses the BSD-2-Clause license, ships a Docker image and had 607 commits in the last year. ## Best for startups Ranked for startups on GitHub stars, commits in the last year, Docker images, open-source licenses, project websites and recent commits. - [Keycloak](https://appsgit.com/apps/keycloak) (37,156 stars, Apache-2.0, Java, Docker): Keycloak has 37,156 GitHub stars, uses the Apache-2.0 license, ships a Docker image and had 3,157 commits in the last year; it replaces Auth0 and Okta. For startups it also scores on a Docker image, a permissive license (Apache-2.0), a project website and a commit in the last 90 days. - [Authelia](https://appsgit.com/apps/authelia) (29,182 stars, Apache-2.0, Go, Docker): Authelia has 29,182 GitHub stars, uses the Apache-2.0 license, ships a Docker image and had 2,474 commits in the last year; it replaces Auth0 and Okta. For startups it also scores on a Docker image, a permissive license (Apache-2.0), a project website and a commit in the last 90 days. - [authentik](https://appsgit.com/apps/authentik) (25,859 stars, MIT, Python, Docker): authentik has 25,859 GitHub stars, uses the MIT license, ships a Docker image and had 5,375 commits in the last year; it replaces Auth0 and Okta. For startups it also scores on a Docker image, a permissive license (MIT), a project website and a commit in the last 90 days. - [Casdoor](https://appsgit.com/apps/casdoor) (14,515 stars, Apache-2.0, Go, Docker): Casdoor has 14,515 GitHub stars, uses the Apache-2.0 license, ships a Docker image and had 1,090 commits in the last year. For startups it also scores on a Docker image, a permissive license (Apache-2.0), a project website and a commit in the last 90 days. - [SuperTokens](https://appsgit.com/apps/supertokens) (15,335 stars, Apache-2.0, Java, Docker): SuperTokens has 15,335 GitHub stars, uses the Apache-2.0 license, ships a Docker image and had 560 commits in the last year. For startups it also scores on a Docker image, a permissive license (Apache-2.0), a project website and a commit in the last 90 days. ## Best for small business Ranked for small business on GitHub stars, commits in the last year, Docker images, open-source licenses, project websites, recent commits and deploy guides. - [authentik](https://appsgit.com/apps/authentik) (25,859 stars, MIT, Python, Docker): authentik has 25,859 GitHub stars, uses the MIT license, ships a Docker image and had 5,375 commits in the last year; it replaces Auth0 and Okta, and appsgit has a step-by-step deploy guide for it. For small business it also scores on a Docker image, an open-source license, a project website, a commit in the last 90 days and an appsgit deploy guide. - [Keycloak](https://appsgit.com/apps/keycloak) (37,156 stars, Apache-2.0, Java, Docker): Keycloak has 37,156 GitHub stars, uses the Apache-2.0 license, ships a Docker image and had 3,157 commits in the last year; it replaces Auth0 and Okta. For small business it also scores on a Docker image, an open-source license, a project website and a commit in the last 90 days. - [Authelia](https://appsgit.com/apps/authelia) (29,182 stars, Apache-2.0, Go, Docker): Authelia has 29,182 GitHub stars, uses the Apache-2.0 license, ships a Docker image and had 2,474 commits in the last year; it replaces Auth0 and Okta. For small business it also scores on a Docker image, an open-source license, a project website and a commit in the last 90 days. - [Logto](https://appsgit.com/apps/logto) (14,652 stars, MPL-2.0, TypeScript, Docker): Logto has 14,652 GitHub stars, uses the MPL-2.0 license, ships a Docker image and had 1,322 commits in the last year; it replaces Auth0. For small business it also scores on a Docker image, an open-source license, a project website and a commit in the last 90 days. - [Casdoor](https://appsgit.com/apps/casdoor) (14,515 stars, Apache-2.0, Go, Docker): Casdoor has 14,515 GitHub stars, uses the Apache-2.0 license, ships a Docker image and had 1,090 commits in the last year. For small business it also scores on a Docker image, an open-source license, a project website and a commit in the last 90 days. ## Best for enterprise Ranked for enterprise on GitHub stars, commits in the last year, open-source licenses and recent commits. - [Keycloak](https://appsgit.com/apps/keycloak) (37,156 stars, Apache-2.0, Java, Docker): Keycloak has 37,156 GitHub stars, uses the Apache-2.0 license, ships a Docker image and had 3,157 commits in the last year; it replaces Auth0 and Okta. For enterprise it also scores on an open-source license and a commit in the last 90 days. - [Authelia](https://appsgit.com/apps/authelia) (29,182 stars, Apache-2.0, Go, Docker): Authelia has 29,182 GitHub stars, uses the Apache-2.0 license, ships a Docker image and had 2,474 commits in the last year; it replaces Auth0 and Okta. For enterprise it also scores on an open-source license and a commit in the last 90 days. - [authentik](https://appsgit.com/apps/authentik) (25,859 stars, MIT, Python, Docker): authentik has 25,859 GitHub stars, uses the MIT license, ships a Docker image and had 5,375 commits in the last year; it replaces Auth0 and Okta. For enterprise it also scores on an open-source license and a commit in the last 90 days. - [Logto](https://appsgit.com/apps/logto) (14,652 stars, MPL-2.0, TypeScript, Docker): Logto has 14,652 GitHub stars, uses the MPL-2.0 license, ships a Docker image and had 1,322 commits in the last year; it replaces Auth0. For enterprise it also scores on an open-source license and a commit in the last 90 days. - [Casdoor](https://appsgit.com/apps/casdoor) (14,515 stars, Apache-2.0, Go, Docker): Casdoor has 14,515 GitHub stars, uses the Apache-2.0 license, ships a Docker image and had 1,090 commits in the last year. For enterprise it also scores on an open-source license and a commit in the last 90 days. ## How this list was made - Candidates: the 12 apps in the identity & SSO category. Archived projects and projects with no commit in the last two years are left out. - Base score: GitHub stars on a log scale plus commits in the last 12 months (log scale, capped at 1,000). - Bonus points for a published Docker image, an OSI-approved open-source license and a commit in the last 90 days. - Each "Best for" section re-ranks the same apps with that audience's profile (for example startups add points for permissive licenses, project websites and recent commits; small business for Docker images and deploy guides). - Source-available apps can rank, but they are labelled and never described as open source. ## FAQ ### Is Keycloak free? Yes. Keycloak is open-source software released under the Apache-2.0 license, so you can self-host it at no cost. You only pay for the server it runs on, and some projects also offer an optional paid cloud plan. ### Which open source SSO and identity provider is best for a startup? Keycloak ranks first for startups, with 37,156 GitHub stars, the Apache-2.0 license and a Docker image; Authelia and authentik follow. The startups ranking adds points for Docker images, permissive licenses, project websites and recent commits on top of stars and activity. ### Which open source SSO and identity provider is best for a small business? authentik ranks first for small business, with 25,859 GitHub stars, the MIT license and a Docker image; Keycloak and Authelia follow. The small business ranking adds points for Docker images, open-source licenses, project websites, recent commits and deploy guides on top of stars and activity. ### Can I self-host these SSO and identity providers with Docker? Yes, all of them. Keycloak, Authelia and authentik publish Docker images, so you can run them on a VPS or home server with Docker Compose. ### Are all of these SSO and identity providers open source? All 10 apps on this list are open source. You can self-host and modify each one under its license. ## Related questions - [What is the best open source budgeting app?](https://appsgit.com/best/open-source-budgeting-software) - [What is the best open source CMS?](https://appsgit.com/best/open-source-cms) - [What is the best open source team chat app?](https://appsgit.com/best/open-source-team-chat) - [What is the best open source file sharing app?](https://appsgit.com/best/open-source-file-sharing) - [What is the best open source analytics tool?](https://appsgit.com/best/open-source-analytics) - [What is the best open source developer tool?](https://appsgit.com/best/open-source-developer-tools) - [What is the best open source email marketing tool?](https://appsgit.com/best/open-source-email-marketing) - [What is the best open source booking and scheduling system?](https://appsgit.com/best/open-source-booking-systems) ## See also - [All identity & SSO apps](https://appsgit.com/categories/identity-sso) - [All utilities apps](https://appsgit.com/categories/utilities) - [All finance & budgeting apps](https://appsgit.com/categories/finance-budgeting) - [Open-source alternatives to Auth0](https://appsgit.com/alternatives/auth0) - [Open-source alternatives to Okta](https://appsgit.com/alternatives/okta) - [Keycloak vs authentik](https://appsgit.com/compare/keycloak-vs-authentik) - [authentik vs Authelia](https://appsgit.com/compare/authentik-vs-authelia) - [How to self-host Authentik with Docker Compose](https://appsgit.com/guides/authentik) --- Canonical page: https://appsgit.com/best/open-source-identity-providers Source: appsgit (https://appsgit.com), the app store for github. Data from the GitHub API, refreshed nightly. Machine access: JSON API https://appsgit.com/api/v1/apps (OpenAPI: https://appsgit.com/openapi.json), MCP server https://mcp.appsgit.com/mcp, full index https://appsgit.com/llms-full.txt.