Top 5 open-source Stytch alternatives in 2026

Stytch is an API-first authentication service, now part of Twilio, known for passwordless login, B2B organizations with SSO and SCIM, and fraud prevention. Teams look for alternatives when:

• Usage grows past the free tier. Stytch is free for 10,000 monthly active users, then charges per MAU.
• They sell to enterprises. Five SSO or SCIM connections are included; each one after that is $125 per month, so every new enterprise customer adds to the bill.
• They want to own the data, run auth in their own region or servers, or avoid depending on one vendor's API.

The five alternatives below are open source. They differ mainly in how much of the login experience they give you: hosted pages and an admin console, or APIs you build screens on, as with Stytch.

At a glance

1. Casdoor

Casdoor gives you what Stytch does without the per-user and per-connection pricing: email and SMS one-time codes, magic links, passkeys and social login, with passwords optional per application. On top of that it has hosted sign-in pages you brand per application, an admin console for users and organizations, and a REST API for everything in the console if you'd rather build your own screens.

For B2B apps, each customer can be its own organization with its own SAML or OIDC identity providers and SCIM provisioning, and adding a connection costs nothing. Self-host it for free, or use Casdoor Cloud: a dedicated instance from $24/month billed yearly ($29 month to month), with no per-user fees.

Trade-offs: Stytch's device fingerprinting and bot detection have no direct equivalent; Casdoor has CAPTCHA providers and limits on failed sign-in attempts instead. See Casdoor vs Stytch.

2. SuperTokens

SuperTokens is the closest to Stytch's developer experience: SDKs for your frontend and backend, with prebuilt React UI, and a passwordless recipe for magic links and one-time passwords by email or SMS. The core is Apache-2.0; the managed service is free to 5,000 MAU, then $0.02 per MAU.

Trade-offs: MFA, account linking and multi-tenancy are paid features, and backend SDKs cover Node.js, Python and Go. See Casdoor vs SuperTokens.

3. Ory

Ory is headless like Stytch: Kratos handles identities and login flows over an API, Hydra is the OAuth 2.0 server, and you build every screen. Passwordless login uses passkeys and other WebAuthn authenticators.

Trade-offs: there are no login pages or admin console in the open-source version, and SAML lives in a separate product, Ory Polis. See Casdoor vs Ory.

4. Logto

Logto is an open-source identity provider with hosted sign-in pages, email and SMS one-time codes, passkeys, and organizations for B2B apps. Logto Cloud has a free tier with 50,000 MAU; Pro starts at $24 per month plus add-ons.

Trade-offs: enterprise SSO, MFA and organizations are paid add-ons in Logto Cloud. See Casdoor vs Logto.

5. Supabase Auth

Supabase Auth supports magic links and six-digit email codes, and keeps users in your Supabase Postgres database. The free plan includes 50,000 MAU; Pro is $25 per month with 100,000 MAU, then $0.00325 per MAU.

Trade-offs: it's built around a Supabase project, and SAML users cost $0.015 per MAU after the first 50. See Casdoor vs Supabase Auth.

Which one should you choose?

• You want hosted login pages, an admin console and B2B SSO without per-connection fees: Casdoor.
• You want SDKs and prebuilt components inside your own app, like Stytch: SuperTokens.
• You want APIs only and will build every screen: Ory.
• You want a multi-tenant cloud with a large free tier: Logto.
• Your app already runs on Supabase: Supabase Auth.

Moving from Stytch to Casdoor, passwordless users keep signing in the same way with codes, magic links or passkeys, and password hashes in bcrypt, Argon2id, PBKDF2 or salted SHA-256 / SHA-512 can be imported as they are. Talk to us if you'd like help with a migration.