Open source Auth0 alternatives
Seven ways to handle authentication, ours included, with the trade offs stated plainly. If you are leaving a managed provider, the useful question is rarely which tool is best. It is which constraint you are trying to get out from under.
What we compared on
Five questions that actually change the decision, and nothing that only sounds like it does.
License
Can you read the source, fork it, and keep running it if the company changes direction or gets acquired.
Hosting
Can it run on infrastructure you control, or only on the vendor's. This decides data residency and the ceiling on your outage exposure.
Pricing model
What the meter counts. Monthly active users, seats, machine to machine tokens, infrastructure, or nothing at all.
Protocols
OAuth 2.0 and OpenID Connect, or a proprietary SDK you inherit and then have to unwind later.
Keys and wallets
Who physically holds the secret that proves a user is who they claim to be. This is the difference most comparisons skip.
Not compared
Logo counts, funding rounds, and review scores. None of them survive contact with a migration.
Auth0 alternatives at a glance
Auth0 is listed first as the baseline most teams are comparing against.
| Project | Open source | Self hosted | Pricing model | Wallet support |
|---|---|---|---|---|
| Auth0 (baseline) | No, proprietary | No, SaaS only | Free tier, then per monthly active user with separate machine to machine pricing | Not built in, custom integration |
| Keycloak | Yes, Apache 2.0 | Yes | Free. You pay for the servers and the operator time | Not built in |
| Ory | Yes, Apache 2.0 | Yes | Free self hosted, paid managed network for the hosted option | Not built in |
| SuperTokens | Yes, open core | Yes | Free self hosted, paid managed tier above a usage threshold | Not built in |
| Authentik | Yes, open core | Yes | Free self hosted, paid enterprise license for support and enterprise features | Not built in |
| Clerk | No, proprietary | No, SaaS only | Free tier, then per monthly active user | Web3 sign in as a login method |
| Sigma Auth | Yes, MIT | Yes | Free self hosted. The hosted service currently has no paywall | Bitcoin signature auth, plus wallet connect across eight chains |
Pricing models change more often than products do, so this table describes the shape of the meter rather than a number. Licenses and tiers verified on 21 August 2026. Corrections are welcome at the contact link below.
On the wallet support row, Sigma is two things at once. Its identity attestation hashes are anchored on BSV, which is the anchor chain in every case. The wallet connect part is about which key a user can generate that identity with: Ethereum, Bitcoin, Bitcoin Cash, Bitcoin SV, Litecoin, Avalanche, ICP, and Solana.
Four differences that are structural, not featural
Most of this list is a choice about who holds what. That is harder to copy than a feature.
The key stays with the user
Users authenticate by signing a challenge with a secp256k1 key held on their own device. The private key is never transmitted to Sigma, which means there is no credential store to breach and no password to reset.
No vendor lock in
MIT licensed and deployable on your own infrastructure. Integration is plain OAuth 2.0, or @sigma-auth/better-auth-plugin if your project already runs Better Auth. If the hosted service stops suiting you, running the same software yourself is a deployment decision rather than a rewrite.
Anchored on BSV, generated from a key you already hold
Read it as two layers. The identity attestation hashes live on BSV through BAP, and that anchor chain does not move. The key used to generate the identity is the other layer, and it can be one a user already holds on Ethereum, Bitcoin, Bitcoin Cash, Bitcoin SV, Litecoin, Avalanche, ICP, or Solana. See the EVM path.
Access follows ownership
Gate a route on NFT ownership, token balance, or a BAP allowlist. Entitlement becomes something the user holds and can transfer, rather than a flag in your database.
The two comparisons people ask for
Sigma Auth vs Clerk
Managed developer experience against self hosted control. Where Clerk is genuinely stronger, and where the custody model diverges.
Read the comparison
Sigma Auth vs Privy
Wallet infrastructure, framed around the question that matters: who holds the keys your users sign with.
Read the comparison
Applications in the Sigma ecosystem