The right Stytch alternative depends on the shape of your product. B2B SaaS teams usually want ready-made organisations, SSO and roles, open-source identity tools suit teams that want to self-host and own their user data, and customisable auth servers sit in between. Choose by the one feature you can't ship without.
Stytch's homepage now says Stytch has joined Twilio. If you built your login flow on it, a change of owner is the first thing to weigh: it may change nothing for you, or it may change the roadmap, the terms or the support you get. Either way, it's a good moment to know your options. Here are eight authentication platforms, in no particular order.
Three shapes of auth product
Authentication tools look alike from the outside, since they all log people in. The difference is what they're shaped around, and that decides how much work you'll do yourself.
B2B SaaS auth and access
WorkOS, PropelAuth and Kinde are built around selling software to businesses. That means organisations, team invites, single sign-on for your customers' staff and roles that control who can do what. Each takes a slightly different angle: enterprise features you can switch on as bigger customers ask for them, auth that comes ready for B2B out of the box, or auth bundled with access management and billing.
Open-source and self-hostable identity
SuperTokens and three other open-source or self-hostable tools let you keep user data on your own infrastructure. They're not interchangeable, though. Hanko leads with passkeys, Logto with multi-tenancy and enterprise SSO, and authentik positions itself as one identity provider for all your apps. Match the tool to the one feature you need most rather than the longest feature list.
Customisable auth you run your way
FusionAuth sits in its own group: auth software and user management you can customise heavily, with the standard protocols developers expect. It suits teams that want more control than a pure hosted API gives them, without building identity from scratch.
The eight in alphabetical order
Unranked. Each line reflects what the vendor says about its own product.
authentik
Best for: Bringing all your authentication into one self-hosted, open-source identity provider, which is how the project describes itself.
FusionAuth
Best for: Customisable auth and user management with SSO, MFA, OAuth2 and OpenID Connect tools, which the vendor calls complete auth software.
Hanko
Best for: Passkeys first: open-source, privacy-first auth for passkeys, 2FA and SSO with full control over your data; the vendor calls it the fastest way to add passkeys.
Kinde
Best for: SaaS founders who want authentication, access management and billing from one developer platform; a free plan is named on the vendor's site.
Logto
Best for: Adding multi-tenancy, enterprise SSO and RBAC to SaaS or AI apps with OIDC and OAuth, per the vendor, which also names a free plan.
PropelAuth
Best for: B2B products that want the right auth tools out of the box; the vendor's line is that a great auth product gets out of your way.
SuperTokens
Best for: Developers who want open-source user authentication so they can build fast and keep control, as the vendor puts it.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
WorkOS
Best for: Making an app enterprise-ready with APIs and SDKs for single sign-on, directory sync and audit logging; a free plan is named.
How they line up
| Tool | Product shape | Good for |
|---|---|---|
| authentik | Self-hosted identity provider | One self-hosted identity provider for every app |
| FusionAuth | Customisable auth and user management | SSO, MFA and OAuth on your own terms |
| Hanko | Open-source passkeys and authentication | Adding passkeys while keeping control of your data |
| Kinde | Auth, access and billing for SaaS | Founders wanting auth and billing together |
| Logto | Open-source auth infrastructure | Multi-tenancy and enterprise SSO for SaaS or AI apps |
| PropelAuth | Authentication for B2B products | B2B products wanting auth tools out of the box |
| SuperTokens | Open-source user authentication | Building fast while keeping control of auth |
| WorkOS | Enterprise-ready auth APIs | SSO, directory sync and audit logs for enterprise deals |
My advice on swapping auth providers
Treat a move of auth provider as a project, not a weekend job. Your users' sessions, passwords or passkeys, linked social logins and any SSO connections your business customers have set up all need a plan. Find out early whether you can export user records, including password hashes, and whether the new provider can import them, because that decides whether your users ever notice the move.
Pick for the product you'll have in two years, not just today. If you sell to businesses, SSO and directory sync will be asked for by your bigger customers sooner than you think. If you're consumer-facing, passkeys and a smooth sign-up matter more. If data must stay in a particular place, self-hosting may settle the question for you. No auth provider can promise your app is secure on its own, and security and data rules vary, so check what applies to you.
If you're comparing more widely, my lists of Auth0 alternatives and Clerk alternatives cover other popular choices, and the guide to SSO providers goes deeper on single sign-on for your own staff.
Do you make authentication or identity software? Tool makers can ask to be considered for a featured place on this list.
Want your tool on this list? Featured spots and reviews here are paid partnerships. Here's how to partner with me.
Frequently asked questions
Why would I move away from my current auth provider?
Common reasons are a change of owner, a feature you need that's missing, or wanting to self-host your user data. Weigh the effort of migrating users against the benefit before you commit.
Can I migrate users without forcing password resets?
Often, if your current provider lets you export password hashes and the new one can import them. Check both sides early, because without that you may need users to reset passwords or sign in again.
What's the difference between B2B and consumer auth?
B2B auth adds organisations, team invites, roles and single sign-on for business customers. Consumer auth focuses on smooth sign-up and login for individuals, often with social logins and passkeys.
Are passkeys ready for everyday use?
Major browsers and phones support them, and they remove the need for passwords. Many teams offer passkeys alongside an existing login method while users get used to them.
Is open-source authentication safe to use?
Open source means you can see the code, but safety depends on how you run, update and configure it. If you self-host, someone on your team needs to own security updates.
Do I need SSO from day one?
Not usually. Most teams add SSO when bigger business customers ask for it. Choosing a provider that supports it later saves a painful switch.
