This article is written by the team that builds Casdoor, so we are not neutral, and we say where we think Casdoor fits and where it doesn't. Facts about other products come from their own websites as of October 25, 2026 (listed under Sources) and may have changed. Spotted something out of date? Tell us.
"Free identity provider" means two different things:
- A free tier of a hosted service. Someone else runs it, and it's free up to a user limit, usually with the features businesses need (enterprise SSO, MFA, custom domains) reserved for paid plans.
- Free, open-source software you run yourself. No user limits and no feature gates, but you supply the server and the operations work.
This article compares both, using each vendor's pricing page as of October 2026. Limits change often, so check the pricing page before you commit.
Free tiers of hosted identity services
| Service | Free up to | Enterprise SSO (SAML / OIDC) on free | MFA on free | Notable limits |
|---|---|---|---|---|
| Auth0 | 25,000 MAU | 1 connection | Pro and Enterprise MFA factors not included | 5 organizations, logs kept 1 day |
| Clerk | 50,000 retained users per app | No | No | Clerk branding can't be removed |
| WorkOS AuthKit | 1,000,000 MAU | Paid, $125 per connection per month | Yes | Custom domain $99 per month |
| Amazon Cognito | 10,000 MAU (Lite, Essentials) | 50 federated MAU, then $0.015 each | TOTP and SMS (SMS billed) | Email MFA and passkeys need Essentials |
| Firebase Auth / Identity Platform | 50,000 MAU | 50 SAML / OIDC MAU, then billed | Not stated on the pricing page | SMS only on the pay-as-you-go plan |
| Supabase Auth | 50,000 MAU | No | Basic MFA; phone MFA paid | Free projects pause after a week of inactivity |
| Entra External ID | 50,000 MAU | Not stated on the pricing page | SMS is a paid add-on | Needs an Azure subscription |
| Stytch | 10,000 MAU | 5 SSO or SCIM connections | Not stated per plan | |
| Logto Cloud | 50,000 MAU | No (paid add-on) | No (paid add-on) | 3 applications, no RBAC or organizations |
| Kinde | 10,500 MAU | 1 connection | Yes | Kinde branding can't be removed |
| Descope | 7,500 MAU | 3 connections | Yes | Hard cap: upgrade to go over |
| Zitadel Cloud | 100 daily active users | 3 identity providers | Yes | Custom domain on Pro |
| SuperTokens (managed) | 5,000 MAU | Multi-tenant SSO is paid | Paid add-on |
Units matter: Clerk counts retained users (people who come back after their first day), Zitadel counts daily active users, and everyone else counts monthly active users. A 100-DAU limit is far smaller than a 50,000-MAU one.
The catch is usually enterprise SSO and MFA. A consumer app can live on most free tiers for a long time. A B2B app hits the wall at its first business customer who asks for SAML, which is free on only a few plans (Auth0 includes 1 connection, Kinde 1, Descope 3, Stytch 5) and costs $75 to $125 per connection per month on Clerk, WorkOS and Stytch beyond that. See auth pricing compared for what the paid plans cost at 100,000 users.
Free identity providers for employees
If you need single sign-on for your team's own apps (workforce identity) rather than login for your product:
- Microsoft Entra ID Free comes with Microsoft 365 and Azure subscriptions and includes SSO to any number of apps and MFA through security defaults (Microsoft Authenticator). Conditional Access needs P1, from $7 per user per month.
- Google Cloud Identity Free covers 50 users by default and can be Google-as-IdP for SAML apps, with 2-Step Verification.
- Okta has no free workforce plan. Its Integrator Free Plan is a non-production environment for up to 10 active users, meant for building and testing integrations.
Free and open-source identity providers
These are free with no user limit. You pay in servers and time instead:
| Project | License | Good for |
|---|---|---|
| Casdoor | Apache-2.0 | One IdP for customers, employees and AI agents: OIDC, OAuth 2.0, SAML, CAS, LDAP, RADIUS, SCIM, MFA and passkeys |
| Keycloak | Apache-2.0 | Enterprise SSO with OIDC and SAML, in Java |
| authentik | MIT, enterprise features separate | Homelabs and companies that also want proxy authentication, LDAP and RADIUS |
| Zitadel | AGPL-3.0 | Multi-tenant B2B SaaS |
| Authelia | Apache-2.0 | 2FA and SSO in front of self-hosted apps behind a reverse proxy |
| Apereo CAS | Apache-2.0 | Universities and CAS-protocol apps |
All of them can be an OpenID Connect provider, and all but Authelia a SAML identity provider, at no cost. For more detail see 6 free and open-source SAML identity providers, the top open-source IAM and SSO solutions, and how to run a self-hosted identity provider.
How to choose
- A side project or an early consumer app: a hosted free tier is the fastest start. Check the user unit and what happens when you go over: some bill you, some stop sign-ins until you upgrade.
- A B2B product: look at the price of enterprise SSO connections and organizations, not the MAU limit. That's where free tiers end.
- Data that must stay in your environment, or a large user base: an open-source IdP has no per-user cost.
- Not sure yet: pick something built on standards (OIDC, SAML) and with a user export, so moving later is a configuration change, not a rewrite.
Where Casdoor fits
Casdoor is free and open source with every feature included: no per-user fees, and SAML, OIDC, LDAP and RADIUS connections, MFA, passkeys, organizations and RBAC are not reserved for a paid edition. If you don't want to run it yourself, Casdoor Cloud runs the same software as a dedicated instance, $24/month billed yearly, with free credit to try it first. See pricing.
FAQ
What is the best free identity provider? For a hosted free tier with the most users, WorkOS AuthKit (1 million MAU, but enterprise SSO is paid per connection). For the most features at no cost, an open-source IdP such as Casdoor or Keycloak, which you host yourself.
Is there a free SAML identity provider? Yes. Casdoor, Keycloak, authentik, Zitadel and Apereo CAS are open-source SAML IdPs, and Google Cloud Identity Free can act as a SAML IdP for up to 50 users by default.
Is there a free OIDC provider? Every service and project in this article can issue OpenID Connect tokens on its free plan. The differences are in user limits, MFA and enterprise connections.
Does free mean no MFA? Not always. Cognito, Kinde, Descope and WorkOS include MFA on free plans; Clerk and Logto don't. Open-source IdPs include MFA at no cost.
Sources
- Auth0 pricing
- Clerk pricing
- WorkOS pricing
- Amazon Cognito pricing
- Firebase pricing
- Supabase pricing
- Microsoft Entra External ID pricing
- Stytch pricing
- Logto pricing
- Kinde pricing
- Descope pricing
- Zitadel pricing
- SuperTokens pricing
- Okta pricing
- Microsoft Entra licensing
- Google Cloud Identity editions
Product names are trademarks of their respective owners.