Open source alternatives to WorkOS

By GitHub stars it is Keycloak, with 37,860 stars and a commit on 13 Nov. Choose Keycloak when you want single sign-on, SAML and OpenID Connect on your own infrastructure, with user data kept in your own database. Next come Better Auth (30,743 stars) and authentik (26,342 stars).

Yes. The code of all 3 is public under Apache 2.0 or MIT, so you can use them with no licence fee. Running one yourself costs the server and your time to look after it, and some makers also sell a hosted plan.

Start from the job you use WorkOS for. Choose Better Auth when you want logins, organisations and SAML SSO in your own code and database, with no per-connection fee. Choose authentik when you need one self-hosted identity provider for staff apps, with LDAP, RADIUS and remote desktop access as well as SAML and OIDC.

All 3: Keycloak, Better Auth and authentik. Each tool's page says what it needs to run.

All 3 we track had a commit in the last 30 days, among them Keycloak, Better Auth and authentik. A recent commit shows the project is kept up, not that it will stay that way.

MIT (2), Apache 2.0 (1). MIT, BSD and Apache let you change and reuse the code freely.

The hosting. WorkOS's maker runs the servers for you; with an open source tool the updates, backups, security fixes and support are yours, unless you take the maker's hosted plan. Features differ too, so check what each one imports and exports before you move your data.