# Casdoor

> Open-source IAM and SSO for customers, employees and AI agents: OIDC, SAML, LDAP, passkeys, MFA and OAuth for MCP servers. Self-host free or use Cloud from $24/month billed yearly.

Casdoor is open source under Apache-2.0. Casdoor Cloud is the managed version run by the Casdoor team: each customer gets a dedicated Casdoor instance and database, priced per instance with no per-user or per-MAU fees. Cloud and self-hosted run the same code, so customers can move between them.

## Casdoor Cloud pricing

Plans start at $24/month billed yearly. New accounts get $20 of free credit. Instances can run in 23 regions.

- Basic: $29/month, or $288/year (save 17%). For small teams getting started with a hosted Casdoor. Includes: Dedicated Casdoor instance and database; OAuth 2.0, OIDC, SAML, CAS, LDAP and SCIM; Your own subdomain at casdoor.com; Hosted in Singapore or Japan; Automatic Casdoor upgrades; No per-user or per-MAU fees; Support via tickets.
- Premium: $79/month, or $780/year (save 18%). For growing start-ups that need their own login domain. Includes: Everything in Basic; Custom domain with managed TLS certificate; Choose from 23 regions and switch any time; 8x5 technical support.
- Enterprise: $249/month, or $2388/year (save 20%). For companies running Casdoor in production. Includes: Everything in Premium; Priority 8x5 technical support; Help with onboarding and migration; Custom terms and invoicing on request.

- [Pricing](https://www.casdoor.com/pricing): Plans, what each includes, regions and pricing FAQ.
- [Cloud console](https://admin.casdoor.com): Sign up and create an instance.

## Use cases

- [Identity and access control for AI agents](https://www.casdoor.com/ai-agents): Make Casdoor the OAuth server for your MCP servers: AI clients register themselves and get tokens scoped to the tools a user approved. Open source.
- [Open-source single sign-on for every app](https://www.casdoor.com/sso): One login for every app: Casdoor is an open-source SSO server with OIDC, SAML, CAS, LDAP, RADIUS and Kerberos, plus MFA and single logout.
- [A SAML 2.0 identity provider you can self-host](https://www.casdoor.com/saml): Casdoor is an open-source SAML 2.0 IdP for AWS, Google Workspace and your own apps, and can also sign users in through Entra ID, Okta or ADFS.
- [LDAP, RADIUS and directory sync, built in](https://www.casdoor.com/ldap): Casdoor has a built-in LDAP server and RADIUS server for legacy apps, VPNs and Wi-Fi, and syncs users from Active Directory, Entra ID and Google Workspace.

## Comparisons

- [How Casdoor compares](https://www.casdoor.com/compare): Index of all comparison pages.
- [Casdoor vs Auth0](https://www.casdoor.com/compare/auth0): Compare Casdoor and Auth0: open source vs proprietary, self-hosted or managed, flat pricing from $24/month billed yearly vs per-MAU pricing, and how to migrate.
- [Casdoor vs Okta](https://www.casdoor.com/compare/okta): Compare Casdoor and Okta: one open-source platform for customers, employees and AI agents, self-hosted free or managed from $24/month billed yearly, versus per-user pricing.
- [Casdoor vs Keycloak](https://www.casdoor.com/compare/keycloak): Compare Casdoor and Keycloak, both Apache-2.0: protocols, built-in Casbin authorization, and a managed cloud from $24/month billed yearly so you don't have to run it.
- [Casdoor vs Clerk](https://www.casdoor.com/compare/clerk): Compare Casdoor and Clerk: open source vs proprietary, any stack vs React components, flat pricing from $24/month billed yearly vs per-user pricing.
- [Casdoor vs WorkOS](https://www.casdoor.com/compare/workos): Compare Casdoor and WorkOS for enterprise SSO and SCIM: no per-connection fees, open source and self-hostable, managed cloud from $24/month billed yearly.
- [Casdoor vs Stytch](https://www.casdoor.com/compare/stytch): Compare Casdoor and Stytch: open source vs proprietary APIs, hosted login and admin console, flat pricing from $24/month billed yearly vs per-MAU pricing.
- [Casdoor vs Descope](https://www.casdoor.com/compare/descope): Compare Casdoor and Descope: open source and self-hostable, no MAU caps or SSO connection limits, managed cloud from $24/month billed yearly.
- [Casdoor vs Kinde](https://www.casdoor.com/compare/kinde): Compare Casdoor and Kinde: open source and self-hostable vs proprietary, flat pricing from $24/month billed yearly vs base fee plus per-MAU overage.
- [Casdoor vs Amazon Cognito](https://www.casdoor.com/compare/cognito): Compare Casdoor and Amazon Cognito: open source and portable vs AWS-only, hosted login and admin console, flat pricing from $24/month billed yearly.
- [Casdoor vs Firebase Auth](https://www.casdoor.com/compare/firebase-auth): Compare Casdoor and Firebase Authentication: SAML, OIDC, MFA and multi-tenancy included, open source and self-hostable, cloud from $24/month billed yearly.
- [Casdoor vs Entra External ID](https://www.casdoor.com/compare/entra-external-id): Compare Casdoor and Microsoft Entra External ID, the successor to Azure AD B2C: open source, region choice, flat pricing from $24/month billed yearly.
- [Casdoor vs Supabase Auth](https://www.casdoor.com/compare/supabase-auth): Compare Casdoor and Supabase Auth: a standalone IdP for all your apps vs auth tied to a Supabase project, and Casdoor Cloud from $24/month billed yearly.
- [Casdoor vs FusionAuth](https://www.casdoor.com/compare/fusionauth): Compare Casdoor and FusionAuth: Apache-2.0 open source vs a free but closed Community edition, and managed hosting from $24/month billed yearly.
- [Casdoor vs Logto](https://www.casdoor.com/compare/logto): Compare Casdoor and Logto: Apache-2.0 vs MPL-2.0, protocols, which features are paid add-ons, and a dedicated managed instance from $24/month billed yearly.
- [Casdoor vs Zitadel](https://www.casdoor.com/compare/zitadel): Compare Casdoor and Zitadel: Apache-2.0 vs AGPL-3.0, flat pricing vs daily active users, and a dedicated managed instance from $24/month billed yearly.
- [Casdoor vs authentik](https://www.casdoor.com/compare/authentik): Compare Casdoor and authentik, two open-source IdPs with SAML, OIDC, LDAP and RADIUS: licensing, pricing, and a managed cloud from $24/month billed yearly.
- [Casdoor vs Ory](https://www.casdoor.com/compare/ory): Compare Casdoor and Ory: an all-in-one IAM with login pages and a console vs headless services you assemble; Casdoor Cloud from $24/month billed yearly.
- [Casdoor vs SuperTokens](https://www.casdoor.com/compare/supertokens): Compare Casdoor and SuperTokens: an SSO server for many apps vs auth embedded in one, MFA included, and a managed instance from $24/month billed yearly.
- [Casdoor vs Authelia](https://www.casdoor.com/compare/authelia): Compare Casdoor and Authelia: a full IAM with user management, SAML and sign-up vs a forward-auth portal; Casdoor Cloud from $24/month billed yearly.

## Integrations

- [Casdoor Marketplace](https://marketplace.casdoor.com): App integrations, identity provider templates and sign-in themes that Casdoor admins install from the console in one click, each with a setup guide.
- [App integrations](https://marketplace.casdoor.com/apps/): Step-by-step single sign-on with Casdoor for self-hosted apps such as Grafana, GitLab, Nextcloud, Vaultwarden and Argo CD.
- [Marketplace index](https://marketplace.casdoor.com/data/index.json): Machine-readable list of every integration.

## Blog

- [Authentication vs Authorization: The Difference, with Examples](https://www.casdoor.com/blog/authentication-vs-authorization): Authentication proves who a user is; authorization decides what they may do. Examples, the protocols and models for each (OIDC, SAML, OAuth 2.0, RBAC, ABAC), HTTP 401 vs 403, and where each check belongs.
- [How to Connect ChatGPT to an MCP Server (with OAuth)](https://www.casdoor.com/blog/connect-chatgpt-to-mcp-server): Add a remote MCP server to ChatGPT as a custom MCP server: what the server needs, the steps in ChatGPT, how OAuth sign-in works (CIMD, DCR, PKCE, redirect URI), and fixes for common errors.
- [Top 5 Open-Source Descope Alternatives in 2026](https://www.casdoor.com/blog/descope-alternatives): Open-source alternatives to Descope without MAU or SSO connection caps: Casdoor, Keycloak, authentik, Logto and SuperTokens compared on pricing, login customization and enterprise SSO.
- [Top 5 Open-Source FusionAuth Alternatives in 2026](https://www.casdoor.com/blog/fusionauth-alternatives): Truly open-source alternatives to FusionAuth: Casdoor, Keycloak, Zitadel, authentik and Logto compared on license, which features are free, and managed hosting prices.
- [JWT vs Session Cookies: Which Should You Use for Authentication?](https://www.casdoor.com/blog/jwt-vs-session): Server-side sessions and JWTs compared: where state lives, revocation, scaling, security pitfalls, and why most apps end up using both, with sessions in the browser and JWTs for APIs.
- [Top 5 Open-Source Kinde Alternatives in 2026](https://www.casdoor.com/blog/kinde-alternatives): Open-source alternatives to Kinde for SaaS auth, organizations and billing: Casdoor, Logto, Zitadel, SuperTokens and Supabase Auth compared on MAU pricing, enterprise SSO and subscriptions.
- [OAuth 2.0 vs OpenID Connect (OIDC): The Difference Explained](https://www.casdoor.com/blog/oauth-vs-oidc): OAuth 2.0 is for authorization, OpenID Connect adds authentication on top. What each one gives you, access tokens vs ID tokens, which flow to use, and common mistakes.
- [Top 5 Open-Source Stytch Alternatives in 2026](https://www.casdoor.com/blog/stytch-alternatives): Open-source alternatives to Stytch for passwordless login and B2B SSO: Casdoor, SuperTokens, Ory, Logto and Supabase Auth compared on pricing, enterprise connections and how much UI you build yourself.
- [What Are Passkeys? Passkeys vs Passwords and How They Work](https://www.casdoor.com/blog/what-are-passkeys): Passkeys explained: how WebAuthn public-key sign-in works, synced vs device-bound passkeys, why they resist phishing, passkeys vs passwords and MFA, and how to add passkey login to your app.
- [What Is an Identity Provider (IdP)? Examples and How It Works](https://www.casdoor.com/blog/what-is-an-identity-provider): An identity provider (IdP) stores users, signs them in and vouches for them to other apps. How IdPs work with OIDC and SAML, IdP vs service provider, examples, and how to choose or self-host one.
- [What Is CIAM? Customer Identity and Access Management Explained](https://www.casdoor.com/blog/what-is-ciam): CIAM explained: how customer identity differs from workforce IAM, the features a CIAM platform needs (sign-up, social login, passwordless, MFA, B2B organizations, consent), how vendors price it, and open-source options.
- [What Is MFA? Multi-Factor Authentication vs 2FA, Methods Compared](https://www.casdoor.com/blog/what-is-mfa): Multi-factor authentication explained: the three factor types, MFA vs 2FA, TOTP, SMS, email, push and passkeys compared on security and friction, phishing-resistant MFA, and how to roll it out.
- [What Is SCIM? User Provisioning Explained, with Examples](https://www.casdoor.com/blog/what-is-scim): SCIM 2.0 explained: the standard API for creating, updating and removing users and groups across apps, how it works with SSO, example requests, and how to add SCIM provisioning to your app.
- [What Is Single Sign-On (SSO)? How It Works, Protocols and Benefits](https://www.casdoor.com/blog/what-is-sso): Single sign-on explained: how one login reaches many apps, the protocols behind it (OIDC, SAML, CAS, LDAP, Kerberos), workforce vs customer SSO, risks, and how to add SSO with an open-source identity provider.
- [Top 5 Open-Source WorkOS Alternatives for Enterprise SSO in 2026](https://www.casdoor.com/blog/workos-alternatives): Open-source alternatives to WorkOS for B2B SaaS: Casdoor, Ory Polis, Keycloak, Zitadel and Logto compared on SAML and OIDC connections, SCIM, multi-tenancy and per-connection pricing.
- [Top 5 Zitadel Alternatives in 2026 (Apache-2.0 and MIT)](https://www.casdoor.com/blog/zitadel-alternatives): Alternatives to Zitadel with permissive licenses or different pricing: Casdoor, Keycloak, authentik, Logto and Ory compared on license, multi-tenancy, protocols and managed hosting.
- [Top 5 Amazon Cognito Alternatives in 2026 (Open Source and Managed)](https://www.casdoor.com/blog/aws-cognito-alternatives): Outgrowing Cognito's hosted UI, per-MAU pricing or AWS lock-in? Casdoor, Keycloak, Supabase Auth, Zitadel and Auth0 compared, and how to migrate users off Cognito.
- [Top 5 Open-Source Clerk Alternatives in 2026](https://www.casdoor.com/blog/clerk-alternatives): Open-source alternatives to Clerk for React, Next.js and everything else: Casdoor, Better Auth, Supabase Auth, Logto and SuperTokens compared on hosting, pricing and how they fit your app.
- [OAuth for AI Agents: OAuth 2.1, DPoP, Token Exchange and MCP](https://www.casdoor.com/blog/oauth-for-ai-agents): How AI agents and MCP clients get access tokens: OAuth 2.1 with PKCE, client ID metadata documents, resource indicators, DPoP, token exchange and the device flow, and what each one protects against.
- [Top 5 Open-Source Okta Alternatives in 2026](https://www.casdoor.com/blog/okta-alternatives): Self-hosted replacements for Okta Workforce Identity: Casdoor, Keycloak, authentik, Zitadel and Authelia compared on SSO protocols, directory sync, MFA and managed options.
- [6 Free and Open-Source SAML Identity Providers (2026)](https://www.casdoor.com/blog/open-source-saml-identity-providers): Self-hosted SAML 2.0 IdPs you can use for free: Casdoor, Keycloak, authentik, Zitadel, Shibboleth and SimpleSAMLphp compared on language, protocols, admin UI and managed options.
- [RADIUS vs LDAP: Differences and How They Work Together](https://www.casdoor.com/blog/radius-vs-ldap): LDAP is a directory you look users up in; RADIUS is a protocol network devices use to ask whether a user may connect. How each works, when you need both, and how to run them from one identity provider.
- [SAML vs OIDC: Differences, Flows and Which to Use](https://www.casdoor.com/blog/saml-vs-oidc): SAML and OpenID Connect both do single sign-on. How their flows, tokens and metadata differ, where each one is the right choice, and how one identity provider can serve both.
- [Single Logout Explained: OIDC RP-Initiated, Back-Channel and SAML SLO](https://www.casdoor.com/blog/single-logout): Why logging out of one app doesn't log you out of the others, and the standards that fix it: OIDC RP-initiated, front-channel and back-channel logout, SAML Single Logout, and token revocation.
- [What Is CAS (Central Authentication Service)? CAS SSO Explained](https://www.casdoor.com/blog/what-is-cas): CAS is a ticket-based single sign-on protocol, still common at universities. How a CAS login works, CAS 1.0 vs 2.0 vs 3.0, how it compares with SAML and OIDC, and which CAS servers you can use.
- [Auth Pricing Compared: Auth0, Clerk, Cognito & More (2026)](https://www.casdoor.com/blog/auth-pricing-comparison): How Auth0, Clerk, WorkOS, Amazon Cognito, Supabase, Zitadel and Casdoor charge for authentication, with a worked example at 100,000 monthly active users.
- [Top 10 Auth0 Alternatives in 2026 (Open Source & SaaS)](https://www.casdoor.com/blog/auth0-alternatives): Ten Auth0 alternatives compared on pricing model, free tier, open source and self-hosting: Casdoor, Clerk, WorkOS, Keycloak, FusionAuth, Logto, Zitadel and more.
- [Top 10 Open-Source IAM & SSO Solutions in 2026](https://www.casdoor.com/blog/best-open-source-iam): Casdoor, Keycloak, authentik, Zitadel, Ory and five more open-source identity providers compared: licenses, protocols, languages and who each one fits.
- [Casdoor vs Keycloak vs authentik vs Zitadel (2026)](https://www.casdoor.com/blog/casdoor-vs-keycloak-vs-authentik-vs-zitadel): A side-by-side comparison of the four most popular self-hostable identity providers: license, stack, protocols, authorization, multi-tenancy and managed hosting.
- [Top 5 Managed Identity Providers with No Per-User Fees](https://www.casdoor.com/blog/dedicated-managed-identity-providers): Most auth SaaS bills per monthly active user on shared infrastructure. These five give you your own instance at a flat price: Casdoor Cloud, Skycloak, Phase Two, Cloud-IAM and FusionAuth.
- [Top 5 Keycloak Alternatives in 2026](https://www.casdoor.com/blog/keycloak-alternatives): Lighter, easier or managed alternatives to Keycloak: Casdoor, authentik, Zitadel, Ory and FusionAuth compared, plus where to get Keycloak hosted if you want to keep it.
- [Top 5 OAuth Providers for MCP Servers and AI Agents (2026)](https://www.casdoor.com/blog/mcp-authorization-servers): Which identity providers can secure remote MCP servers under the 2026 MCP authorization spec: WorkOS, Casdoor, Auth0, Descope and Keycloak compared.

## Open-source Casdoor

- [Documentation](https://casdoor.ai/docs/overview): Installation, configuration, protocols, providers and SDKs. A full index for AI assistants is at https://casdoor.ai/llms.txt.
- [Try with Docker](https://casdoor.ai/docs/basic/try-with-docker): Run Casdoor locally in one command.
- [Source code](https://github.com/casdoor/casdoor): Casdoor on GitHub.
- [Live demo](https://demo.casdoor.com): A writable demo instance that resets every few minutes.

## Contact

- Sales and migrations: https://tawk.to/casbin
- Support: support@casbin.com