Keycloak
96 · HealthyIdentity and access management server with SSO, OIDC, SAML and user federation (CNCF).
Open source Auth & identity
authentik
88 · HealthyIdentity provider with flows, SSO across OIDC, SAML, LDAP and a proxy outpost.
Logto
86 · HealthyAuth and identity service for SaaS and AI apps, built on OIDC with organizations and RBAC.
ZITADEL
84 · HealthyMulti-tenant identity platform with event-sourced audit trail and B2B organizations.
Ory Kratos
79 · StableHeadless identity and user-management server with an API-first design.
Authelia
76 · StableSingle sign-on and two-factor portal that sits in front of web apps via a reverse proxy.
SuperTokens
74 · StableAuthentication backend with prebuilt UI, sessions and multi-tenancy.
Directory / Auth & identity / ZITADEL
ZITADEL
Multi-tenant identity platform with event-sourced audit trail and B2B organizations.
Will it still be around?
Health 84/100 · Healthy
Activity, bus factor and issue responsiveness. Breakdown
Can a business use it freely?
Open source (copyleft)
GNU Affero General Public License v3.0 · relicensed to something stricter in 2025. Details
Alternative to
Savings proposal
At 25 users, Okta costs about $150 a month and self-hosting ZITADEL about $264, so Okta is cheaper at this size. Self-hosting pays off from 49 users.
List price: Okta Starter Suite, billed annually. SSO alone is $2 per user; most companies add adaptive MFA and lifecycle management ($14 to $17 per user). Minimum contract $1,500 a year. Source, checked 2026-10-07.
Extra cost over 3 years
$5,304
Pays for itself
Not at this size
Extra cost in year one
$2,568
Each month
$150 → $264
Show as a table
| Month | Okta | Self-hosted | Difference |
|---|---|---|---|
| Today | $0 | $1,200 | −$1,200 |
| Month 3 | $450 | $1,992 | −$1,542 |
| Month 6 | $900 | $2,784 | −$1,884 |
| Month 9 | $1,350 | $3,576 | −$2,226 |
| Month 12 | $1,800 | $4,368 | −$2,568 |
| Month 18 | $2,700 | $5,952 | −$3,252 |
| Month 24 | $3,600 | $7,536 | −$3,936 |
| Month 30 | $4,500 | $9,120 | −$4,620 |
| Month 36 | $5,400 | $10,704 | −$5,304 |
Assumptions you can change
Self-hosting ZITADEL usually means an app server, a database and a cache or worker. Hours are for one engineer; the server cost is a typical cloud VPS with backups and grows with the number of people using it.
Not included: paid editions or features of ZITADEL (see What's free?), large data migrations, and compliance work. All amounts in US dollars at list price; your negotiated price may differ.
Health score: 84/100
Activity45% weight
100/100
- Last commit yesterday (100/100).
- 645 commits in the past 12 months (100/100).
- 50+ releases in the past 12 months (100/100).
Bus factor30% weight
100/100
- Top contributor wrote 21% of the last 97 commits (past 12 months).
- 19 people authored those commits.
Responsiveness25% weight
35/100
- 74% of all issues are closed (989 open, 2837 closed) (74/100).
- 3 of 30 recent issues got a reply or were closed (10/100).
Score v2. How the health score works.
License
GNU Affero General Public License v3.0 · Open source (copyleft)
OSI-approved license that requires sharing changes under the same license when you distribute (AGPL: also when you offer it over a network).
Detected by GitHub as AGPL-3.0.
License history
- 2025-04-02: Apache-2.0 → AGPL-3.0 · Moved to AGPL with ZITADEL v3. (commit)
What's free?
Enterprise features many open-core projects keep for paid plans.
| Feature | Self-hosted, free? |
|---|---|
| SSO (SAML) | Unknown |
| SSO (OIDC) | Unknown |
| SCIM provisioning | Unknown |
| Audit logs | Unknown |
| Role-based access control | Unknown |
| Multi-tenancy | Unknown |
We haven't verified which of these features are free for this project yet.
GitHub metrics
| Stars | 15k | Forks | 1.4k |
|---|---|---|---|
| Last commit | yesterday | Commits, 12 months | 645 |
| Releases, 12 months | 50+ | Last release | 6 days ago |
| Contributors | 250 | Active authors | 19 in last 97 commits |
| Open issues | 989 | Closed issues | 2.8k |
Snapshot from 2026-10-08.