Auth0 alternatives for passkey-first apps

The best Auth0 alternatives for a passkey-first app are the ones that speak standard OpenID Connect, treat passkeys as a primary sign-in method rather than an add-on, let you run sign-in on your own domain, and don’t tie your code to a proprietary SDK. Hosted options include Clerk, Amazon Cognito, Firebase Authentication and Gatekeep. If you’d rather run it yourself, Keycloak, Ory and Authentik are the common self-hosted choices.

Which one fits depends less on feature checklists and more on a few structural questions. This post covers those questions first, then walks through each category fairly. We build Gatekeep, so read our take with that in mind, and verify any provider’s current features and pricing on their own site.

What to look for in an Auth0 alternative

Standards, not SDKs

The single biggest factor in long-term cost is how tightly your app is coupled to the provider. If your app talks to its identity provider through standard OpenID Connect (authorization code flow, PKCE, a discovery document and a JWKS endpoint), switching later is mostly a configuration change. If your app calls provider-specific APIs and renders provider-specific components everywhere, switching is a rewrite.

Ask: can I integrate with a generic OIDC library in my framework, with no vendor SDK? Can I verify tokens with any JOSE library against a published JWKS?

Passkeys as a first-class sign-in method

Many providers now “support passkeys”, but that can mean very different things:

• Passkeys offered as a second factor after a password.
• Passkeys offered as an optional sign-in method alongside passwords and SMS.
• Passkeys as the primary method, with no password at all.

Only the last one removes the password database and the phishable fallbacks. If a password or SMS code still works, attackers will use it. Our post on why passkeys stop phishing explains why the fallback matters.

Custom domains and the RP ID

Passkeys are bound to a domain called the relying party ID (RP ID). A passkey created on login.provider.com won’t work on login.yourapp.com. If you start on a provider’s shared domain and later move to your own, your users have to enroll new passkeys.

So check whether custom domains are available on the plan you’ll actually use, and plan to use one from the start.

Account recovery

Every passkey system needs an answer to “I lost my phone”. Look at how recovery works, what it proves, and whether it revokes the old credentials. See passkey account recovery for the trade-offs.

Pricing shape

Most hosted providers charge by monthly active users. Look at the curve, not the starting price. Our Auth0 pricing breakdown shows how to model it.

Hosted alternatives

Clerk

Clerk is known for embeddable, prebuilt UI components, especially for React, and it’s popular with Next.js teams. Sign-in and user-management screens drop straight into your app, which makes early development fast. The trade-off is the flip side of that convenience: the deeper you build on its components and APIs, the more your app is shaped around Clerk. It’s a strong choice if you want polished UI out of the box and you’re comfortable with that coupling. Check Clerk’s pricing page for current plans.

Amazon Cognito

Cognito is AWS’s user directory and authentication service. If your infrastructure is already on AWS, it fits naturally with IAM, API Gateway and Lambda. It supports OIDC, and its hosted UI can handle sign-in for you. Teams often find it takes more configuration to get a polished experience than purpose-built auth products, so budget engineering time accordingly.

Firebase Authentication

Firebase Auth is Google’s client-side authentication service, closely integrated with the rest of Firebase and Google Cloud. It’s easy to start with from mobile and web clients using Firebase’s SDKs. Integration is primarily SDK-driven, so it suits apps already committed to the Firebase ecosystem better than apps that want a provider-neutral OIDC setup.

Gatekeep

Gatekeep is hosted passkey-only sign-in. Users sign in with Face ID, Touch ID, Windows Hello, Android or a security key, including synced passkeys from iCloud Keychain, Google Password Manager and 1Password. There are no passwords and no SMS codes. Email is used only to verify an address at signup and for account recovery.

Apps integrate over standard OpenID Connect with mandatory PKCE and no client secret, so Auth.js, openid-client, Passport, Spring Security, Authlib, golang.org/x/oauth2 or ASP.NET Core all work without an SDK. Tokens are signed with Ed25519 and verifiable against a public JWKS. Gatekeep is in early access, which you should weigh if you need a long track record today.

Self-hosted alternatives

Self-hosting removes per-MAU pricing and gives you full control of the data. It also makes you responsible for patching, upgrades, high availability, key management and incident response for the most security-sensitive system you run. Be honest about whether your team wants that job.

Keycloak

Keycloak is a mature, Java-based identity and access management server. It supports OIDC and SAML, user federation (LDAP, Active Directory), fine-grained admin and a large configuration surface. It’s a common pick for organizations that need enterprise protocols on their own infrastructure. Expect to invest in learning its realm and client model and in operating it.

Ory

Ory offers a set of focused, API-first components (Kratos for identity, Hydra for OAuth 2.0 and OIDC, and others) written in Go. You compose the pieces you need and build your own UI on top. That gives a lot of flexibility, at the cost of more assembly than an all-in-one server. Ory also offers a hosted version.

Authentik

Authentik is a self-hosted identity provider with a focus on flexible flows and a friendly admin interface. It supports OIDC, SAML and proxy-based authentication, and is popular for homelab and internal-tool setups as well as small teams who want one place to manage sign-in for many apps.

A quick comparison

A checklist before you switch

1. Can you integrate with a generic OIDC library and no vendor SDK?
2. Can users sign in with a passkey and nothing else, with no password fallback?
3. Is a custom domain available on the plan you’ll use, so passkeys bind to your domain?
4. How does account recovery work, and does it revoke lost credentials?
5. What does the bill look like at two times and ten times your current MAU?

Where Gatekeep fits

If your answers point to “passkeys only, standard OIDC, my own domain”, that’s exactly what Gatekeep is built for. Read the overview, see how sign-in works, compare pricing, and request early access.