Top 5 open-source Descope alternatives in 2026

Descope is a proprietary auth service known for its drag-and-drop flow editor, where you design sign-up, login and MFA journeys visually. Teams look for alternatives when they hit its plan limits:

• MAU and SSO caps. The free plan covers 7,500 monthly active users and 3 SSO connections. Pro starts at $249 per month billed yearly with 10,000 MAU and 5 SSO connections, and Growth at $799 per month with 25,000 MAU and 10 connections, with usage-based overages above that.
• Self-hosting. Descope runs only in its own cloud.
• Lock-in. Flows built in a vendor's editor don't move to another product.

The five alternatives below are open source and can be self-hosted.

At a glance

1. Casdoor

Casdoor removes the caps: Casdoor Cloud has no MAU or SSO connection limits, and the open-source edition is free with every feature. Each B2B customer can be its own organization with its own SAML or OIDC identity providers and SCIM provisioning.

Instead of a flow editor, you configure each application's sign-in and sign-up: which methods are offered (password, email or SMS code, magic link, passkey, social and enterprise providers), which MFA methods are optional or required, which fields the sign-up form asks for, and how the page looks, with themes, custom CSS and your own domain. Casdoor Cloud is a dedicated instance from $24/month billed yearly ($29 month to month).

Trade-offs: there's no drag-and-drop journey designer; branching logic beyond the settings goes in your own code or a webhook. See Casdoor vs Descope.

2. Keycloak

Keycloak lets you assemble authentication flows from executions in its admin console, which is the closest open-source equivalent to designing journeys, and it's Apache-2.0 with a large community.

Trade-offs: no managed service from the project, and custom flow steps and themes mean Java and FreeMarker work. See Casdoor vs Keycloak.

3. authentik

authentik builds every login, enrollment and recovery journey from visual flows and stages, which is the most Descope-like experience among open-source projects. It speaks OIDC, SAML, LDAP and RADIUS.

Trade-offs: there's no hosted version, and enterprise features cost $5 per internal user or $0.02 per external user per month. See Casdoor vs authentik.

4. Logto

Logto has a polished hosted sign-in experience configured in its console, with organizations for B2B apps. Logto Cloud's free tier includes 50,000 MAU; Pro starts at $24 per month plus add-ons.

Trade-offs: enterprise SSO, MFA and organizations are paid add-ons in Logto Cloud. See Casdoor vs Logto.

5. SuperTokens

SuperTokens puts the flow in your code: frontend and backend SDKs with prebuilt React UI, which you change through overrides. The managed service is free to 5,000 MAU, then $0.02 per MAU.

Trade-offs: MFA, account linking and multi-tenancy are paid features. See Casdoor vs SuperTokens.

Which one should you choose?

• You want no MAU or connection caps, B2B SSO included, and a flat-priced cloud or free self-hosting: Casdoor.
• You want to design journeys visually and self-host: authentik, or Keycloak if you need its ecosystem.
• You want a hosted service with a large free tier: Logto.
• You want the login flow written in your own code: SuperTokens.

Coming from Descope, export your users and import them into Casdoor (bcrypt, Argon2id, PBKDF2 and salted SHA-256 / SHA-512 hashes are verified as they are), recreate social and enterprise connections as providers, and switch apps to Casdoor's OIDC or SAML endpoints. Talk to us if you'd like help.