Open-source alternatives to Authlib

This project is a .NET identity stack and server framework used to build certified OpenID Connect and OAuth 2.0 identity providers. It provides the core logic required to issue and validate security tokens and manage user authentication across various grant types and protocol flows. The framework includes a protocol translation layer that bridges OpenID Connect and SAML to enable interoperability between different identity providers. It also supports a stateless mode of operation, which removes built-in validation and storage to allow for manual control over token and client verification. Th

Hydra is a headless identity server that functions as a certified OAuth2 and OpenID Connect provider. It is designed as an authentication engine that manages authorization handshakes and token lifecycles while remaining decoupled from the user interface. The project distinguishes itself through a headless architecture, allowing external management of login and consent flows. It provides specialized capabilities for dynamic client registration, JSON Web Token issuance, and a system for rotating encryption secrets without service downtime. The system covers a broad range of identity operations

This is a Java library and framework for creating, parsing, and validating JSON Web Tokens within Java and Android applications. It provides a comprehensive toolkit for handling signed and encrypted tokens, including the generation and verification of JWS and JWE objects. The project differentiates itself through a flexible architecture that supports pluggable JSON serialization and custom signature algorithms. It includes a dedicated key manager for generating, encoding, and organizing JSON Web Keys and key sets, as well as support for hardware security module integration. The library cover

This project is a command-line tool for managing public key infrastructure and digital identities. It provides a comprehensive suite for X.509 certificate lifecycle management, including the generation, signing, renewal, and revocation of certificates and signing requests. The tool distinguishes itself through specialized security capabilities such as binding cryptographic credentials to TPMs and HSMs for hardware-backed identity attestation. It also provides dedicated support for machine identity security, using short-lived SSH certificates and mTLS to secure non-human workloads. Broad capa

node-oidc-provider is a framework for building OpenID Certified authorization servers and identity providers within Node.js environments. It provides a comprehensive suite of tools for managing the full lifecycle of OAuth 2.0 and OpenID Connect services, including user authentication, client registration, and the issuance and validation of identity and access tokens. The project distinguishes itself through a highly modular architecture that allows developers to integrate authentication services directly into existing web application stacks. It supports advanced customization through a middle

OpenAuth is a standards-based authentication server and identity provider that implements OAuth 2.0 and OpenID Connect protocols. It serves as a centralized system for managing user identities, issuing access tokens, and orchestrating authentication flows across various services. The project functions as a federated identity gateway, aggregating external providers such as Google, GitHub, Microsoft, Apple, and Discord into a unified login flow. It distinguishes itself with a multi-tenant architecture that supports pluggable identity providers and customizable user interface frameworks for bran

Grant is an OAuth authentication proxy that interfaces applications with third-party identity providers to manage handshakes and token exchanges through a transparent proxy layer. It provides a secure OAuth client implementation that validates OpenID Connect tokens and manages multi-provider identity under a unified configuration. The project differentiates itself through support for serverless authentication flows, allowing the proxy logic to be deployed as cloud functions. It implements advanced security mechanisms including Proof Key for Code Exchange and private key JWT authentication to

This project is a PHP library for implementing a spec-compliant OAuth 2.0 authorization server. It serves as an authentication framework for managing user identities and client authorizations, providing the necessary components to issue and validate access and refresh tokens. The server supports a wide range of standardized authorization flows, including authorization code exchange, device grants, implicit flows, and PKCE enforcement. It handles complex token lifecycles through refresh token rotation, scope management, and the use of asymmetric keys for signing digital tokens. The system pro

jwt-go is a Go library for creating, parsing, and verifying signed JSON Web Tokens. It provides a pluggable signing interface that supports multiple cryptographic algorithms, including HMAC, RSA, ECDSA, and RSA-PSS, allowing tokens to be signed and verified with different security properties. The library is built around a signing-method registry and a token-parsing pipeline that splits a JWT string into its header, payload, and signature segments for validation. It includes typed error classification for common failure modes such as invalid signatures, expired tokens, or malformed input, and

The Google API PHP Client Library is a development kit for interacting with Google Cloud services and APIs. It provides standardized service interfaces to retrieve and manipulate data, serving as a comprehensive SDK for executing network requests across Google cloud platforms. The library features a specialized authentication handler for OAuth 2.0, managing authorization flows, access tokens, and offline access via refresh tokens. It includes a service account authenticator that uses JSON key files or application default credentials for server-to-server communication, as well as mechanisms fo

This is a Model Context Protocol server that exposes Windows desktop automation and system administration functions to large language models. It provides programmatic control of mouse, keyboard, windows, and UI elements on Windows through simulated user input, while also enabling LLMs to manage the Windows registry, processes, files, and execute PowerShell commands through a remote interface. The server supports multiple transport protocols including stdio, SSE, and streamable HTTP, allowing flexible integration with different language model clients. It implements OAuth 2.0 with PKCE for secu

GAM is a command-line tool for administering Google Workspace and Cloud Identity. It translates command-line arguments into structured API calls, enabling administrators to manage users, groups, organizational units, and domain settings across a Google Workspace environment. The tool handles authentication through OAuth2 flows, service accounts, and workload identity federation, and supports multi-tenant configurations for managing multiple domains or cloud projects from a single installation. GAM distinguishes itself through its batch processing and automation capabilities. It can process la

FastMCP is a Python framework designed for building servers that expose functions, resources, and prompts to AI models using the Model Context Protocol. It simplifies the development process by automatically deriving tool metadata, input schemas, and documentation directly from Python function signatures and type hints. The framework provides a unified container for managing these components, allowing developers to build modular applications that integrate seamlessly with AI assistants. The project distinguishes itself through its support for interactive, server-defined user interface compone

GoTrue is a JWT identity provider and user management API. It functions as an OAuth 2.0 compliant server that handles user registration and authentication while issuing signed JSON Web Tokens to control access to protected API resources. The service integrates external identity providers to allow users to sign in using third-party accounts. It also includes an SMTP notification service for delivering password resets, signup confirmations, and account recovery emails. The system covers broader capabilities for user account management, including the ability to update user profiles and manage c

This project is an OAuth 2.0 client library and OpenID Connect SDK designed for integrating Microsoft identity platforms into JavaScript applications. It serves as a cross-platform authentication client for managing user identities and daemon services across browser-based and server-side environments. The library provides tools for acquiring and managing JSON Web Tokens to secure access to protected web APIs. It supports various authentication flows, including single-page application authentication, server-side identity management in Node.js, and non-interactive authentication for background

Spring Authorization Server is an OAuth 2.1 and OpenID Connect 1.0 authorization server built on Spring Security. It implements the full protocol surface for issuing access and refresh tokens, including authorization code, client credentials, device code, and token exchange grants, as well as pushed authorization requests and user consent management. The server also functions as an OpenID Connect provider, supporting ID tokens, userinfo, discovery, logout, and dynamic client registration. The project distinguishes itself through an extensible framework that allows custom grant types, pluggabl

jose is a cryptography library for signing, encrypting, and verifying tokens and messages using the JSON Object Signing and Encryption standards. It provides a toolkit for the implementation of JSON Web Tokens, JSON Web Signatures, and JSON Web Encryption. The library serves as a high-level interface for the Web Crypto API, allowing for the generation, import, and export of symmetric secrets and asymmetric key pairs. It handles the encryption and decryption of web messages and the validation of digital signatures to ensure data integrity and identity. Its capabilities cover cryptographic key

PRAW is a Python wrapper for the Reddit API, functioning as a REST API client and social media data crawler. It provides a programmatic interface to fetch data, manage account content, and interact with the platform. The library implements a comprehensive OAuth 2.0 client supporting multiple authorization flows, including password, implicit, and refresh tokens, as well as read-only guest access. It distinguishes itself through a rate-limit-aware request scheduler that tracks server-side throttling to prevent API quota exhaustion and employs lazy-loading resource objects to fetch data only whe

PyJWT is a Python library for encoding, decoding, and verifying JSON Web Tokens (JWTs). It provides comprehensive JWT functionality including algorithm-agnostic signing and verification, supporting both symmetric HMAC shared-secret cryptography and asymmetric RSA/ECDSA public-key cryptography for flexible trust models. The library implements a claim-based validation pipeline that checks issuer, audience, expiration, and other time-based claims during token decoding, with configurable clock skew tolerance for distributed systems. It requires callers to explicitly specify allowed signing algori

Dex is an OpenID Connect provider and identity federation proxy that translates authentication signals from various upstream sources into a unified OpenID Connect interface. It functions as a multi-protocol identity broker, enabling client applications to implement a single standard while delegating user verification to external identity providers. The project distinguishes itself through a pluggable connector architecture that bridges disparate protocols including LDAP, SAML, and OAuth2. It provides specific integrations for services such as GitHub, Google, GitLab, and Microsoft, while offer

twitteroauth is a PHP library and REST API wrapper used for authenticating and interacting with the Twitter API. It functions as an OAuth 1.0a client that manages the secure handshake process to authorize user accounts and obtain access tokens. The library handles the three-legged authorization flow, including the generation of authorization URLs and the requesting of security tokens. It automates the calculation of cryptographic signatures for requests and manages token-based sessions to maintain authenticated state. The project provides capabilities for social media content management, suc

This project is an open-source identity provider and single sign-on platform that centralizes user authentication for multiple web applications and services. It functions as a multi-protocol authentication gateway, verifying user identities and issuing tokens through the CAS protocol as well as industry standards including SAML, OAuth2, and OpenID Connect. The system acts as a federated identity server, allowing authentication to be delegated to external third-party or corporate identity providers. It distinguishes itself through identity attribute governance, which manages which specific use

This library is a PHP toolkit for managing OAuth 2.0 authentication flows and connecting applications to external service providers. It provides a standardized framework for handling token exchanges, managing authorization grants, and retrieving user profile information from diverse identity platforms. The project is distinguished by its inheritance-based provider pattern, which allows developers to build custom integration clients by extending base logic to support unique service workflows and non-standard API specifications. It employs interface-driven contracts to ensure consistent behavio

clasp is a command-line interface for managing Google Apps Script projects, enabling developers to create, sync, and deploy scripts from a local development environment. It provides an alternative to the cloud-based script editor, allowing version control, offline editing, and integration with standard development workflows. The tool supports TypeScript transpilation, so developers can write type-annotated code that compiles to JavaScript for the Apps Script runtime. Authentication is handled via OAuth 2.0, and users can synchronize local files with remote projects using ignore patterns simil

This is a Ruby implementation library for encoding, decoding, and verifying JSON Web Tokens according to the RFC 7519 standard. It provides the primary tools for token signing and encoding, integrity verification, and the extraction of payloads and headers. The project includes a comprehensive JSON Web Key manager for importing, exporting, and resolving key sets. This system facilitates the generation of key thumbprints and the resolution of specific verification keys based on token identifiers. The library covers a wide range of security validation mechanisms, including the verification of

This project is a collection of Go packages and a programmatic interface for interacting with Google services and Google Cloud resources via REST APIs. It functions as a client library and SDK that transforms raw HTTP requests into structured Go function calls. The library utilizes discovery-based client generation to create type-safe clients from API discovery documents. It separates the acquisition of authorization tokens from the request logic through a token-source based authentication model. The project covers identity management and authentication via OAuth 2.0, service accounts, and A

This project is an authentication and authorization platform built on the Spring framework that functions as a centralized identity provider and authorization server. It manages user identities and protects resources by implementing standardized protocols to verify credentials and issue secure tokens for web applications. The platform distinguishes itself by providing a comprehensive framework for managing complex authorization flows and identity verification. It supports dynamic client registration to automate the onboarding of third-party applications and utilizes relational database persis