Instead of Auth0

Hosted login, SSO and user management.

Worth the work

Keycloak is the standard and it is a career. Authentik is the one I would actually install for a small team: modern UI, sensible defaults.

You lose: The developer experience and the free tier.

Start here

Authentik

MIT (open core)a weekendactive

Good UI and real SSO. Upgrade paths need care.

github.com/goauthentik/authentik goauthentik.io

A database, object storage or mail config, plus backups.

Also worth a look

KeycloakApache-2.0a projectactive
Every protocol, every feature, and a lot of concepts.
github.com/keycloak/keycloak www.keycloak.org
ZitadelAGPL-3.0a weekendactive
Cloud-native and clean. Smaller community.
github.com/zitadel/zitadel zitadel.com

Head to head

Authentik vs KeycloakAuthentik is the one you can install on a Tuesday. Keycloak is the one that does every protocol.

Facts checked 8 November 2026. Licences, activity and archive status come from each project's own repository; the verdict and the cost lines are the desk's.