Top 5 Zitadel alternatives in 2026

Zitadel is a Go identity platform built for multi-tenant B2B SaaS: organizations, delegated administration, an event-sourced data model and a managed cloud. Teams look for alternatives for three reasons:

• The license. Zitadel moved to AGPL-3.0 with version 3. If you modify it and let users interact with it over a network, you must offer them your modified source, which some legal teams don't accept.
• Daily active user pricing. Zitadel Cloud is free for 100 daily active users; Pro is US$100 per month with 25,000 DAU included, and Enterprise is custom-priced.
• Protocols. Apps and devices that only speak CAS, LDAP or RADIUS need another server next to it.

At a glance

1. Casdoor

Casdoor is the closest match: a Go identity platform where one instance holds many organizations, each with its own users, groups, roles, applications, identity providers and admins, but licensed under Apache-2.0, so you can modify and embed it without sharing your changes.

It speaks OIDC, OAuth 2.0 and SAML like Zitadel, and adds CAS, LDAP and RADIUS for legacy apps, VPNs and Wi-Fi, plus Casbin for ACL, RBAC and ABAC permissions. Data lives in ordinary SQL tables in MySQL, PostgreSQL or SQLite. Casdoor Cloud is a dedicated instance from $24/month billed yearly ($29 month to month), with no per-user fees.

Trade-offs: Zitadel's event-sourced model keeps every change as an event, which some teams want for auditing. See Casdoor vs Zitadel.

2. Keycloak

Keycloak is Apache-2.0, a CNCF incubating project, and the most widely deployed open-source identity server. Each realm is a separate tenant with its own users, clients and settings.

Trade-offs: there's no managed service from the project, and it's heavier to run than a single Go binary. See Casdoor vs Keycloak.

3. authentik

authentik is MIT-licensed at its core, with visual login flows, OIDC, SAML, LDAP and RADIUS, and proxy outposts for apps with no login of their own.

Trade-offs: no hosted version, and enterprise features cost $5 per internal user or $0.02 per external user per month. See Casdoor vs authentik.

4. Logto

Logto is an MPL-2.0 identity provider with organizations for B2B apps and SDKs for popular frameworks. Logto Cloud has a free tier with 50,000 MAU; Pro starts at $24 per month plus add-ons.

Trade-offs: in Logto Cloud, enterprise SSO, MFA and organizations are paid add-ons. See Casdoor vs Logto.

5. Ory

Ory is a set of Apache-2.0 headless services in Go: Kratos for identities, Hydra for OAuth 2.0 and OIDC, Keto for permissions. Ory Network production plans start at $770 per year.

Trade-offs: you build the login UI yourself, and SAML is a separate product, Ory Polis. See Casdoor vs Ory.

Which one should you choose?

• You like Zitadel's organizations model but need Apache-2.0 or a flat price: Casdoor.
• You want the most established project with Red Hat behind it: Keycloak.
• You self-host for a team or homelab and like visual flows: authentik.
• You prefer TypeScript and a per-MAU cloud with a large free tier: Logto.
• You want headless APIs and will build every screen: Ory.

Migrating from Zitadel to Casdoor

Export users with Zitadel's API and import them into Casdoor; bcrypt, Argon2id, PBKDF2 and salted SHA-256 / SHA-512 hashes can be imported as they are, so users keep their passwords. Map each Zitadel organization to a Casdoor organization, recreate applications (OIDC and SAML apps only need a new issuer URL and client credentials), and move apps over one at a time. Talk to us if you'd like help.