Keycloak
96 · HealthyIdentity and access management server with SSO, OIDC, SAML and user federation (CNCF).
7 open source projects replace Amazon Cognito, ranked by how safe each is to depend on.
Identity and access management server with SSO, OIDC, SAML and user federation (CNCF).
Identity provider with flows, SSO across OIDC, SAML, LDAP and a proxy outpost.
Auth and identity service for SaaS and AI apps, built on OIDC with organizations and RBAC.
Multi-tenant identity platform with event-sourced audit trail and B2B organizations.
TypeScript authentication framework with email and social login, passkeys, two-factor, organizations and SSO plugins.
Headless identity and user-management server with an API-first design.
Authentication backend with prebuilt UI, sessions and multi-tenancy.






Health and license are separate verdicts: a project can be well maintained and still not be open source.
| Project | Health | License | Stars |
|---|---|---|---|
| Keycloak | 96 · Healthy | Free to useApache-2.0 | 37k |
| authentik | 91 · Healthy | Free core, paid extrasMIT | 26k |
| Logto | 86 · Healthy | Free core, paid extrasMPL-2.0 | 15k |
| ZITADEL | 84 · Healthy | Free, share hosted changesAGPL-3.0Relicensed 2025 | 15k |
| Better Auth | 83 · Healthy | Free to useMIT | 30k |
| Ory Kratos | 78 · Stable | Free to useApache-2.0 | 14k |
| SuperTokens | 74 · Stable | Free core, paid extrasApache-2.0 | 15k |
Amazon Cognito is a paid auth & identity product. See all open source auth & identity tools, ranked the same way.
Scores last refreshed from GitHub on 9 October 2026. How we score.