Top 5 Amazon Cognito alternatives in 2026

Amazon Cognito is the path of least resistance on AWS: a user pool is a few clicks away and the free tier is generous. Teams start looking for alternatives when they hit the same few walls:

• The hosted login pages are hard to make look like your product, even with the newer managed login branding.
• User pool settings are hard to change later. Which standard attributes are required, and whether users sign in with a username or an email, can't be changed after the pool is created, and custom attributes can't be removed or renamed.
• Pricing has several meters. Lite, Essentials and Plus tiers are priced per MAU, users who sign in through SAML or OIDC are billed at a separate rate, and SMS goes through Amazon SNS.
• It only runs on AWS. Moving to another cloud, or on premises, means moving identity too.

Here are five alternatives, all of which can still run on AWS if you want to stay there.

At a glance

1. Casdoor

Casdoor is an open-source identity provider with hosted login and sign-up pages you can fully restyle (custom CSS, HTML and themes per application), an admin console, and every major protocol: OIDC, OAuth 2.0, SAML, CAS, LDAP, RADIUS and SCIM.

It runs as one Go service with a SQL database, so on AWS it fits on EC2, ECS or EKS with RDS, and the same deployment works on any other cloud. Casdoor Cloud is a dedicated instance with its own database from $24/month billed yearly ($29 month to month), with no per-user fees, so federated SAML users don't cost extra.

Trade-offs: no equivalent of Cognito identity pools for handing out temporary AWS credentials; you'd use AWS IAM's own OIDC federation instead. Casdoor Cloud doesn't have SOC 2 or ISO 27001 reports yet. See Casdoor vs Amazon Cognito.

2. Keycloak

Keycloak is the most established open-source identity server: SAML and OIDC, identity brokering, LDAP and Active Directory federation, and themeable login pages. Many AWS teams run it on EKS.

Trade-offs: you run and upgrade a Java service yourself, and there's no managed offering from the project. See Keycloak alternatives and Casdoor vs Keycloak.

3. Supabase Auth

Supabase Auth is the auth server inside Supabase. If you're also moving your database, it's convenient: users live in your Postgres, and row-level security policies use the signed-in user directly. The free plan includes 50,000 MAU; Pro is $25 per month with 100,000 MAU.

Trade-offs: it's built around a Supabase project rather than being a standalone IdP, and it isn't a SAML identity provider for other apps. See Casdoor vs Supabase Auth.

4. Zitadel

Zitadel is a Go identity platform for multi-tenant B2B SaaS, with organizations, delegated administration and a managed cloud.

Trade-offs: AGPL-3.0, and Zitadel Cloud is priced by daily active users (free up to 100; Pro is $100 per month with 25,000). See Casdoor vs Zitadel.

5. Auth0

Auth0 is the managed option with the most polish and integrations: Actions for custom logic, a large marketplace and strong documentation.

Trade-offs: proprietary and priced by MAU, with separate B2C and B2B plans, so the bill grows with your user base, as it does on Cognito. See Auth0 alternatives.

Migrating off Cognito

1. Export profiles. The Cognito API exports user attributes, but not password hashes.
2. Decide how users get a password in the new system: a password reset email, a passwordless or social sign-in on first login, or a lazy migration that checks the password against Cognito once (InitiateAuth) and stores it in the new IdP.
3. Recreate app clients. Apps that use the Cognito hosted UI or OIDC only need a new issuer URL, client ID and secret.
4. Move apps one at a time, keeping Cognito running until the last one is switched.

Talk to us if you'd like help planning a migration to Casdoor.

Which one should you choose?

• You want to keep everything on AWS but own your identity layer, with a flat price: Casdoor.
• You have Java experience and want the largest community: Keycloak.
• You're moving your database to Supabase too: Supabase Auth.
• You're building multi-tenant B2B SaaS: Zitadel or Casdoor.
• You want fully managed and per-MAU pricing is fine: Auth0.