WorkOS Alternatives: Open-Source and Self-Hosted

Last updated: June 2026

The strongest open-source, self-hostable WorkOS alternative for B2B SaaS is Keycloak. It gives you full SAML and OIDC SSO, SCIM (now a native experimental feature, with mature third-party extensions as an alternative), and the Organizations feature for per-customer tenancy, all under the Apache 2.0 license with no per-connection fees. If you want WorkOS-style enterprise readiness without closed-source billing or vendor lock-in, Keycloak is the most complete starting point. The right pick still depends on your criteria: licensing, whether you self-host or buy SaaS, how deep your B2B feature needs go, and how much identity work your team wants to own.

WorkOS is great at one thing: making a B2B app enterprise-ready fast. SSO, Directory Sync, and a polished admin portal, all behind a clean API. But that convenience is commercial and closed-source, and per-connection costs and lock-in push plenty of developers to look around. This guide rounds up the alternatives worth knowing, open-source first, with honest notes on where each one fits.

This is a roundup, not a head-to-head. If you want the deep one-on-one, see our Keycloak vs WorkOS comparison.

What does WorkOS actually do, and why look for alternatives?

WorkOS sits between your B2B SaaS app and your customers’ identity providers. Your customer brings their Okta, Entra ID, or Google Workspace tenant. WorkOS handles the SAML and OIDC federation, normalizes user profiles, syncs directories through SCIM, and hands enterprise IT admins a self-serve portal to wire up their own SSO connection. Its hosted user management product, AuthKit, also covers email and password, social, and passwordless login, so WorkOS can run your full auth flow, not just the enterprise edge. Even so, the enterprise-readiness layer (SSO, Directory Sync, the admin portal) is where WorkOS earns its keep, and it is commercial and closed-source.

Developers go looking for alternatives for a few recurring reasons. Per-connection pricing can sting once you sign many enterprise customers. Closed-source means you cannot inspect, extend, or self-host the thing that controls access to your product. And data residency rules in healthcare, finance, or government often demand that identity data stays inside infrastructure you control. Open-source and self-hosted options answer all three.

One distinction matters before we compare. Some tools on this list are full identity providers that can replace your entire auth stack. Others, like WorkOS, are enterprise-feature layers that complement an existing one. We will flag which is which.

The alternatives at a glance

Here is the quick scan before the details. “B2B SSO” means SAML and OIDC single sign-on aimed at enterprise customers. “SCIM / Directory Sync” covers automated user provisioning and deprovisioning. Multi-tenancy notes are in each section below.

A note on naming: open core means a free open-source base with some enterprise features held back for paid tiers. We call that out per tool so there are no surprises.

Why is Keycloak the top open-source alternative for B2B?

Keycloak is the most feature-complete open-source identity provider available, and for B2B SaaS it covers the WorkOS job and then some. It speaks full SAML 2.0 and OIDC, federates to upstream providers like Entra ID, Okta, Google, and LDAP, issues its own tokens, manages sessions, and ships an Admin REST API for everything. It is Apache 2.0 licensed, runs on Quarkus, and self-hosts cleanly on Kubernetes or Docker. No per-connection fee gates the enterprise features.

The piece that makes Keycloak a real WorkOS alternative rather than just “an IdP” is the Organizations feature. Organizations model per-customer tenants inside a single realm. Each org can have its own members, its own identity provider link for SSO, and its own domain-based routing, so a new enterprise customer can bring their own SAML or OIDC connection without you spinning up a separate realm each time. That is the multi-tenant pattern B2B SaaS needs. We cover it in depth in multi-tenancy in Keycloak using the Organizations feature.

A precise note on SCIM, since it matters for Directory Sync parity. Keycloak now ships a native SCIM Realm API, introduced as an experimental feature in the 26.x line and enabled with the scim-api feature flag. It supports the core create, read, update, and delete operations for users and groups against the SCIM 2.0 spec, with Microsoft Entra ID compatibility as an early target. Because it is still experimental and missing some pieces (bulk operations and custom schemas, for example), many production deployments still reach for a mature community or commercial extension instead. Either way, SCIM provisioning on Keycloak is a real, well-trodden option rather than something you build from scratch.

The honest trade-off: Keycloak gives you everything, which means you operate it. Running an HA cluster, tuning the database, and handling upgrades is real work. That is the gap Skycloak fills with managed Keycloak hosting, so you keep the open-source power and skip the on-call.

For the full one-on-one breakdown, read the Keycloak vs WorkOS comparison.

Is Authentik a good self-hosted WorkOS alternative?

Authentik is a strong choice for teams that want a modern, self-hosted IdP with a friendly admin UI and less ceremony than Keycloak. It is open core: the base is open source, with some enterprise features in a paid tier. Authentik supports SAML and OIDC as both provider and consumer, handles SCIM provisioning, and includes a flow-based configuration model that many self-hosters find approachable.

For B2B, Authentik can broker to your customers’ identity providers and supports application-level access policies. It leans on its flow builder for customizing login and enrollment, which is flexible without dropping into code. Its community is smaller than Keycloak’s, and its production track record is shorter, so weigh that against the nicer out-of-the-box experience. For a team that values setup speed and a clean dashboard over maximum extensibility, Authentik is a genuinely good fit.

What about Ory for an API-first stack?

Ory takes a composable, API-first approach: separate open-source components for identity (Kratos), OAuth2 and OIDC (Hydra), permissions (Keto), and a gateway (Oathkeeper). It is Apache 2.0 licensed, and Ory also offers a managed cloud, Ory Network, if you would rather not run the pieces yourself. This is the most “build your own identity platform from parts” option on the list.

That design is its strength and its catch. If your team wants precise control and is comfortable assembling and operating multiple services, Ory is excellent and very flexible. But the enterprise B2B conveniences WorkOS sells out of the box, turnkey SAML connection management, a customer-facing SSO admin portal, and packaged Directory Sync, are more “assemble it yourself” with Ory. SAML support comes via additional components, and SCIM-style provisioning is something you wire up rather than toggle. Pick Ory when composability and API ergonomics matter more than a batteries-included B2B portal.

How does FusionAuth compare?

FusionAuth is a single, self-contained identity application you can download and run for free, with paid tiers and a hosted option on top. It is not open source in the OSI sense, but the free self-host tier is generous and popular with teams that want one app instead of a cluster of services. It supports SAML and OIDC, SCIM provisioning, MFA, and a clean admin UI, and it is known for thorough documentation.

For B2B, FusionAuth offers tenants and applications as first-class concepts, which maps well to multi-customer SaaS. You can isolate configuration and users per tenant and connect each to upstream identity providers. The main thing to verify against WorkOS is the self-serve admin portal experience: WorkOS makes customer IT admins configure their own SSO connection, whereas with FusionAuth you typically own more of that setup. If you want broad features in a single deployable binary, FusionAuth is a comfortable pick. We also cover Keycloak identity brokering with FusionAuth if you end up running both.

Where does SuperTokens fit?

SuperTokens is a developer-first, open-core authentication platform that started from embedded session management and login flows. The core is open source and self-hostable, with managed hosting and enterprise features (including SSO) available in paid tiers. Teams tend to reach for SuperTokens when they want auth that feels close to their code, with SDKs and prebuilt UI components rather than a separate IdP server to administer.

On the B2B front, SuperTokens has grown features for multi-tenancy and SSO, but enterprise SSO sits in its paid offering, and SCIM-style Directory Sync is more limited than what Keycloak, Authentik, or FusionAuth provide. So it is a solid WorkOS alternative for teams whose first need is great embedded auth with some B2B SSO on the roadmap, rather than heavy directory provisioning on day one. If your enterprise checklist is long today, one of the fuller IdPs is the safer bet.

What are the closest commercial WorkOS peers?

If staying open-source is not a hard requirement, three managed SaaS platforms compete with WorkOS directly on B2B features. None are self-hostable, but each is enterprise-ready out of the box, which is the whole point of WorkOS in the first place.

Stytch offers a B2B suite with organization-based multi-tenancy, SAML and OIDC SSO, and SCIM, plus strong passwordless and fraud tooling. It is the closest “API like WorkOS” peer for teams that just want a managed enterprise-auth layer. Frontegg goes broader, bundling SSO and SCIM with end-to-end B2B user management UI: self-serve admin portals, entitlements, and embeddable account screens, so it can replace more of your in-app account surface. Auth0 is the established incumbent: full SAML and OIDC, organizations for B2B, and SCIM on enterprise plans, with the largest ecosystem and docs of the group.

The shared trade-offs are the same ones that send people looking in the first place: closed-source, no self-host, and managed-vendor lock-in. If those are dealbreakers, scroll back up to the open-source options. If they are not, these three are credible. For more on going managed versus open, see Auth0 alternatives: open source and managed.

How should you choose between these WorkOS alternatives?

Match the tool to your actual constraints, not to a feature-count contest. Four criteria do most of the deciding:

Licensing and data control

If you need the source, the freedom to extend, or data that never leaves your infrastructure, you want open source and self-host: Keycloak, Authentik, or Ory (all Apache 2.0 or open core). FusionAuth and SuperTokens give you self-host with caveats on licensing or paid-tier features. The pure SaaS peers (Stytch, Frontegg, Auth0) trade that control for zero operations.

How much identity work you want to own

WorkOS exists because B2B SSO is fiddly and teams want it solved without owning it. Self-hosting any open-source IdP means you own deployment, upgrades, and uptime. If your team is small and identity is not your product, either pick a SaaS peer or run managed Keycloak so you get open-source features without the operational tax.

Depth of B2B feature coverage

For full multi-tenancy plus SSO plus directory provisioning, Keycloak (with Organizations and either native SCIM or an extension), FusionAuth, Authentik, Stytch, Frontegg, and Auth0 all qualify. Ory and SuperTokens can get there but expect more assembly or paid tiers for the enterprise pieces.

Replace your auth, or just add enterprise features

Keycloak, Authentik, Ory, FusionAuth, SuperTokens, and Auth0 can be your primary identity provider. WorkOS can play either role: its AuthKit product can run your full auth flow, while its SSO and Directory Sync layer can also bolt enterprise features onto auth you already run. Decide which job you are actually hiring for.

Frequently asked questions

What is the best open-source alternative to WorkOS?

Keycloak is the strongest open-source, self-hostable alternative to WorkOS for B2B SaaS. It is Apache 2.0 licensed and delivers full SAML and OIDC SSO, upstream identity federation, and per-customer tenancy through its Organizations feature, with no per-connection fees. SCIM provisioning is available through a native experimental feature in the 26.x line, or via a mature community or commercial extension. Authentik and Ory are also solid open-source options depending on whether you prefer a polished UI or an API-first, composable stack.

Does Keycloak support SCIM like WorkOS Directory Sync?

Yes, with a caveat on maturity. Keycloak now includes a native SCIM Realm API, added as an experimental feature in the 26.x releases and turned on with the scim-api feature flag. It handles create, read, update, and delete for users and groups under the SCIM 2.0 spec. Because it is still experimental and does not yet cover everything (bulk operations and custom schemas, for instance), many teams still run a mature community or commercial SCIM extension in production. Either route is well supported. If automated directory sync is a hard day-one requirement, plan for the native feature flag or an extension, or evaluate tools like FusionAuth, Authentik, Stytch, or Auth0 that include SCIM in their offering.

Can I self-host a WorkOS alternative?

Yes. Keycloak, Authentik, and Ory are open source and self-hostable, and FusionAuth and SuperTokens offer self-host tiers (with some licensing and paid-feature caveats). WorkOS itself, along with Stytch, Frontegg, and Auth0, are SaaS-only with no self-hosted option. Self-hosting gives you data control and predictable scaling but means you own upgrades and uptime. Managed Keycloak via Skycloak is the middle path: open-source features without running the infrastructure.

Is WorkOS an identity provider or an add-on layer?

Both, depending on how you adopt it. WorkOS started as an enterprise-feature layer (SSO federation, Directory Sync, and an admin portal on top of your existing authentication), and that is still its core selling point. But its AuthKit product also handles email and password, social, and passwordless login, so WorkOS can act as the primary auth system for your whole user base if you want it to. Full open-source IdPs like Keycloak, Authentik, Ory, and FusionAuth, along with Auth0, can likewise replace your entire auth stack. The deciding question is usually whether you want self-hostable, open-source control or a managed commercial service.

Which WorkOS alternative is best for B2B multi-tenancy?

For open-source B2B multi-tenancy, Keycloak’s Organizations feature is the standout: it models per-customer tenants in a single realm, each with its own members and SSO connection. FusionAuth’s tenants and applications cover similar ground, and Authentik supports multi-application access policies. On the SaaS side, Stytch, Frontegg, and Auth0 all offer organization-based multi-tenancy. See multi-tenancy in Keycloak using the Organizations feature for the implementation details.

Summary

WorkOS solves enterprise readiness fast, but its closed-source, per-connection model is exactly what sends developers looking for alternatives. If open source and self-hosting matter, Keycloak leads the pack: full SAML and OIDC SSO, the Organizations feature for B2B multi-tenancy, and SCIM via a native experimental feature or a mature extension, all under Apache 2.0 with no per-connection billing. Authentik and Ory are excellent open-source picks too, one for a clean self-hosted UI, the other for an API-first, composable stack. FusionAuth and SuperTokens round out the self-host options with their own trade-offs.

Prefer staying managed? Stytch, Frontegg, and Auth0 cover the same B2B ground as polished SaaS, just without the source code or self-host. The decision comes down to four things: licensing and data control, how much identity work you want to own, the depth of B2B features you need, and whether you are replacing your auth or just adding enterprise features on top.

Run Keycloak without the operational tax

Keycloak gives you everything WorkOS does for B2B, plus the freedom of open source. The catch is operating it: clustering, upgrades, backups, and uptime. Skycloak handles all of that with fully managed Keycloak hosting, so you get full SAML and OIDC SSO, the Organizations feature for per-customer tenancy, and room to add SCIM, without the on-call. See how managed Keycloak hosting works and skip the infrastructure work entirely.