Most developers leaving an open source auth library choose between two routes. Hosted identity platforms handle login, SSO and user data for you, while self-hostable or highly configurable services keep more control in your hands. Work out how much you want to build versus configure, then shortlist two from the matching group.
Open source auth is a great place to start, because you can see exactly how sign-in works and run it where you like. The trade-off shows up later, when a customer asks for SSO, an audit trail or a directory sync and you're the one building it. This list covers seven services for teams moving on from SuperTokens, in no particular order.
Build it or configure it
SuperTokens describes itself, plainly, as open source user authentication. That's the thread to pull on when you compare replacements. The thing to test is how each one handles three things: sign-in itself, single sign-on for business customers, and where your user data lives.
Some services in this list hand you a finished login experience and admin tools, and you configure them. Others give you building blocks and APIs, and you assemble the flow inside your own app. Neither is wrong. A small team shipping fast usually wants more done for it, while a team with strict data rules may want to run identity on its own servers. Be honest about which camp you're in before you look at features.
It's also worth thinking about who'll maintain it in two years' time. A flow you've customised heavily is great until the person who built it leaves, while a hosted service you've barely touched is easy to hand over but harder to bend to unusual requirements. There's no single right answer, but it's a decision you should make on purpose rather than by accident.
Seven sign-in services from A to Z
Alphabetical and in no particular order. Each line reflects how the vendor describes its own product.
Auth0
Best for: Product teams wanting a ready-made login and authorisation layer for users and AI agents, which the vendor describes as production-ready.
Descope
Best for: Teams building sign-in journeys for customers, business partners and AI agents, including MCP servers, from what the vendor calls an external IAM platform.
Frontegg
Best for: B2B SaaS companies needing login, SSO, SCIM, multi-tenancy and a self-service admin portal for their own customers; a free plan is named.
FusionAuth
Best for: Developers who want auth and user management they can customise, with SSO, MFA, OAuth and OpenID Connect support listed by the vendor.
Ory
Best for: Engineering teams who'd like the option to self-host; the vendor describes cloud-native, API-first identity for apps, enterprises and AI agents, with a free plan named.
PropelAuth
Best for: Young B2B companies that want auth tools ready out of the box; the vendor says it's built for AI-native companies.
WorkOS
Best for: SaaS teams selling to larger companies who need single sign-on, directory sync and audit logging added through APIs and SDKs, as the vendor lists them.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Comparing the auth platforms
| Tool | Category | Good for |
|---|---|---|
| Auth0 | Authentication and authorisation platform | Ready-made sign-up and login for many kinds of app |
| Descope | External identity platform | Designing sign-in journeys for customers, partners and agents |
| Frontegg | B2B customer identity | Multi-tenant B2B apps with a customer admin portal |
| FusionAuth | Customisable auth and user management | SSO, MFA and OAuth set up your own way |
| Ory | Self-hostable identity and access | Running identity on your own infrastructure |
| PropelAuth | B2B auth for AI-native startups | Small B2B teams that want auth out of the way |
| WorkOS | Enterprise-readiness APIs | SSO, directory sync and audit logs for enterprise deals |
Who each one is built for
Frontegg, PropelAuth and WorkOS all lean towards B2B software, where your customers are companies with their own users, admins and login rules. If enterprise buyers keep asking for SSO and directory sync, start with this group.
Ory and FusionAuth suit teams that want more control, whether that's self-hosting, customising flows or choosing exactly which standards to support. Auth0 and Descope are broad identity platforms covering customer sign-up journeys and, increasingly, AI agents as well as people.
Advice for developers changing identity providers
Treat an auth migration like a database migration, not a library swap. Map every place your app reads a user ID, a session or a role before you start, and plan how existing users will sign in on day one without resetting passwords if you can avoid it. Read each vendor's docs on importing users and password hashes early, because that's the step that decides how painful the move will be.
Keep security and privacy duties in view too. Rules on storing personal data vary by country, so check what applies to you with your regulator. For wider reading on protecting customer-facing apps, see security essentials for customer-facing platforms and how API testing tools help web developers.
Moving user accounts without locking people out
- Export users with their IDs, emails, verified flags and password hashes, and confirm the new service can import that hash format.
- Run the old and new login side by side for a short window, so anyone who slips through can still get in.
- Recreate roles, organisations and SSO connections before you switch, and test each with a real customer admin.
- Update every webhook, API key and redirect URL, then search your code for anything still pointing at the old service.
- Tell customers in advance if their login screen or SSO setup will change.
Do you make authentication or identity software? Tool makers can ask to be considered for a featured place on this list.
Want your tool on this list? Featured spots and reviews here are paid partnerships. Here's how to partner with me.
Frequently asked questions
What's the difference between authentication and authorisation?
Authentication checks who someone is, usually through a login. Authorisation decides what they're allowed to do once they're in, such as which data or admin screens they can see.
Should I self-host authentication?
Self-hosting gives you more control over data and where it lives, but you take on updates, uptime and security patches. Hosted services take that work off you.
What is SSO and do small SaaS products need it?
Single sign-on lets a company's staff log in with their work account. Small products often don't need it early, but business customers start asking for it as deals get bigger.
Can I move users without forcing a password reset?
Often, yes, if the new service can import your existing password hashes. Check each vendor's migration docs before you commit.
Do auth services handle AI agents as well as people?
Several now say they do, with ways for software agents to sign in and act on a user's behalf. Check exactly what each vendor supports before you build on it.
