Open-source alternatives to Oauth2 Client

This is a Go library for obtaining, refreshing, and attaching OAuth 2.0 access tokens to HTTP requests. It provides a generic token source interface with interchangeable implementations for different OAuth 2.0 grant types, and wraps the Go net/http transport layer to automatically attach access tokens as Authorization headers on outgoing requests. The library supports the authorization code flow, generating consent page URLs and exchanging authorization codes for tokens. It also implements the device authorization grant for authentication on devices without a browser, and the resource owner p

Hanko is an open-source identity provider and customer identity and access management system. It serves as a passkey authentication service and an OAuth and SAML SSO gateway, allowing applications to authenticate users and issue tokens via standard identity protocols. The project distinguishes itself through a strong focus on passwordless access using WebAuthn-based passkeys and email-based passcodes. It provides framework-agnostic authentication interfaces as customizable web components that can be embedded directly into web applications to handle login, registration, and profile management.

Deepagents is an LLM agent orchestration platform and stateful application server designed for deploying and managing AI agents built with computational graphs. It provides a containerized runtime environment that handles agent execution, state persistence, and the versioning of AI assistants. The platform distinguishes itself through deep integration with the Model Context Protocol, allowing agents to function as servers that expose tools and capabilities to external clients. It features a sophisticated observability suite for capturing execution traces, performing LLM-based evaluations agai

Casdoor is a centralized identity and access management platform that functions as an OAuth 2.0 authorization server. It provides a comprehensive suite of services for managing user identities, authentication sessions, and access policies across both web and machine-to-machine applications. Built with a decoupled frontend-backend architecture in Go, the platform supports high-concurrency environments and offers a web-based management interface for administrative tasks. The platform distinguishes itself through its extensive support for federated identity management, allowing integration with

FastHTML is a full-stack Python web framework designed for building interactive web applications using pure Python. It functions as an HTMX integration framework and a Python HTML domain-specific language, allowing developers to generate HTML structures using native objects and functions instead of external templating files. The framework is distinguished by its native support for real-time bidirectional communication via WebSockets and Server-Sent Events, enabling server-side updates to be pushed to the browser without full page reloads. It further integrates identity management through OAut

Doorkeeper is an OAuth 2 authorization server and provider for Ruby on Rails and Grape applications. It provides the necessary framework to build an authorization server that issues and validates security tokens for third-party applications, effectively acting as a security middleware to protect API endpoints. The project integrates an identity layer via OpenID Connect to verify user identities and retrieve profile information. It supports a variety of security patterns, including the implementation of the PKCE flow for public clients and the issuance of stateless JSON Web Tokens. Its broade

Goth is a Go library that provides a consistent, provider-agnostic interface for authenticating users through dozens of third-party OAuth and OAuth2 services. It defines a pluggable provider interface and a central registry where providers are registered by name, enabling dynamic lookup and invocation during authentication flows. The library manages the multi-step OAuth authorization process by generating redirect URLs and validating callback responses, and returns a standardized user profile with common fields like email, name, and avatar URL across all supported providers. The library disti

Nhost is an open-source backend as a service that provides a managed PostgreSQL database, authentication, and file storage accessible through a unified GraphQL API. It functions as a backend infrastructure orchestrator, enabling the deployment and management of full-stack environments using containerization and command-line automation. The platform distinguishes itself by automating the transformation of relational database tables into a secure GraphQL API and providing an integrated identity provider that supports passwords, magic links, and OAuth. It also includes a serverless function runt

Next-auth is an authentication library and identity framework used to manage user sign-in and session state across web applications. It provides a system for handling user identity through OAuth, OpenID Connect, and passwordless sign-in flows. The project features a multi-provider framework that integrates third-party identity services and custom directory backends. It supports passwordless authentication via email magic links or hardware keys and utilizes a database-agnostic storage layer to persist authentication states across different database types or in-memory. Security is managed thro

Bruno is a local-first API client designed for building, testing, and managing network requests across a wide range of protocols. By storing all collections and configurations as plain-text files directly on the local filesystem, it enables native version control and offline access, ensuring that project data remains under user control without requiring cloud synchronization. The platform distinguishes itself through a declarative approach to API management, utilizing a domain-specific language to define request parameters and metadata. This architecture supports a robust testing environment

Vendure is a Node.js e-commerce engine and headless commerce framework built with NestJS and TypeScript. It serves as a multi-channel commerce platform that manages product catalogs, orders, and customers via a strongly typed GraphQL API. The platform is distinguished by its highly extensible architecture, featuring a customizable administrative dashboard where developers can inject custom React components and entity views. It supports multi-channel commerce, allowing the isolation of products, currencies, and regional catalogs from a single unified backend. The engine covers a broad range o

AngularFire is a set of tools for connecting applications to Firebase services. It provides a library of client-side interfaces for managing authentication, object storage, NoSQL databases, and serverless functions. The project utilizes observables and dependency injection to integrate cloud services into the application hierarchy. It features a reactive interface for streaming real-time data, managing document-based databases, and tracking authentication state as a continuous stream of tokens. The platform covers a broad range of cloud capabilities, including identity verification, binary f

This project is an OAuth 2.0 client library and OpenID Connect SDK designed for integrating Microsoft identity platforms into JavaScript applications. It serves as a cross-platform authentication client for managing user identities and daemon services across browser-based and server-side environments. The library provides tools for acquiring and managing JSON Web Tokens to secure access to protected web APIs. It supports various authentication flows, including single-page application authentication, server-side identity management in Node.js, and non-interactive authentication for background

Kanidm is a centralized identity management server designed to handle authentication, authorization, and directory services across distributed infrastructure. It provides a comprehensive framework for managing human and service accounts, utilizing a schema-driven database to store identity records, group memberships, and system attributes. The platform supports a wide range of authentication methods, including passkeys, passwords, and standard protocols like OAuth2, OIDC, LDAP, and RADIUS. The system distinguishes itself through a granular access control engine that enforces security policies

Octelium is a zero-trust network access platform and identity-aware proxy designed to secure private HTTP, SSH, and SQL resources. It functions as a secure gateway that validates human and workload identities using OIDC, SAML, and FIDO2 passkeys before granting access to internal applications and SaaS APIs. The system is distinguished by its secretless access broker, which injects credentials—such as API keys, passwords, and AWS Sigv4 signatures—at the gateway level so users can access databases and cloud resources without managing secrets. It further specializes in AI gateway administration,

React-admin is a framework for building data-driven administrative interfaces that connect to REST or GraphQL backends. It provides a comprehensive suite of tools for managing the full lifecycle of administrative applications, including resource-oriented routing, declarative form scaffolding, and context-driven state management. By utilizing a modular adapter-based architecture, the framework abstracts backend communication, allowing developers to build consistent CRUD interfaces that handle data fetching, authentication, and synchronization automatically. The project distinguishes itself thr

Tinyauth is an authentication middleware service and identity provider that verifies user identities to grant system access. It operates as a standalone server or as an authentication gateway, utilizing a reverse proxy model to intercept requests and validate credentials before traffic reaches protected backend services. The project functions as an OpenID Connect provider for single sign-on experiences and an OAuth 2.0 gateway that delegates verification to external providers such as Google and GitHub. It also acts as an LDAP authentication server, allowing for centralized user management and

This project provides a TypeScript software development kit for the Model Context Protocol, a standard designed to facilitate bidirectional communication between AI applications and external data sources or tools. It serves as a foundational framework for building both clients and servers, enabling language models to interact with external systems through a unified, decoupled interface. The SDK distinguishes itself by implementing a transport-agnostic connection layer that supports both local standard input-output streams and remote HTTP endpoints. It utilizes a JSON-RPC message bus to manage

Vercel is a cloud platform for building, deploying, and scaling web applications. It provides a unified infrastructure that automates the build process by detecting project frameworks and distributing static and dynamic content through a global content delivery network. The platform executes application logic using serverless functions that scale automatically based on real-time traffic demand. The platform distinguishes itself through a centralized AI gateway that proxies requests to multiple model providers, enabling standardized authentication, observability, and cost tracking. It supports

Payload is a headless content management system and application framework that uses a code-first approach to define data schemas and administrative interfaces. By utilizing a centralized, type-safe configuration object, it automatically generates database schemas, API endpoints, and a fully customizable admin panel. The system is built on a database-agnostic architecture, allowing it to interface with various storage engines while providing a unified, type-safe API for server-side operations, REST, and GraphQL. What distinguishes Payload is its deep extensibility and developer-centric design.

This project is a cross-platform messaging SDK and client development library used to build custom Telegram applications. It functions as a comprehensive framework that manages network encryption, local data storage, and API communication, providing a C-compatible JSON interface that allows integration with any programming language. The library distinguishes itself by providing a full database manager for encrypted local caching and synchronized state, alongside a dedicated bot framework for creating interactive bots with business account integration. It enables the implementation of speciali

This project is a reverse proxy server that secures internal web services by enforcing authentication against external identity providers. It acts as a gatekeeper for incoming HTTP traffic, validating user identity before forwarding requests to protected backend applications. By integrating with OAuth2 and OIDC providers, the proxy ensures that only authorized users can access internal resources. The proxy distinguishes itself through its flexible session management and granular access control. It maintains authenticated user state across requests using either encrypted client-side cookies or

Dex is an OpenID Connect identity provider that functions as an identity federation gateway. It authenticates users and issues signed tokens for applications by using a variety of pluggable connectors to interface with external identity sources. The project focuses on federating multiple external identity providers into a single authentication portal. It maps diverse external authentication sources to a uniform internal user representation and manages the orchestration of authorization handshakes between clients and identity sources. Capability areas include centralized user authentication,

JustAuth is an OAuth 2.0 authentication library designed to integrate multiple third-party login providers into a single interface. It abstracts various social login APIs and identity services, allowing applications to manage authentication using the OAuth 2.0 and OIDC protocols. The project provides a multi-provider identity integrator that replaces the need for individual vendor software development kits. It includes a toolkit for defining custom authentication platforms and proprietary identity services by specifying custom OAuth protocols and endpoints. The library manages the full authe

AllAboutBugBounty is a curated collection of bug bounty techniques and payloads for web application security testing. It serves as a reference resource covering common web vulnerabilities and exploitation methods for security researchers, providing a structured approach to identifying and exploiting web application security flaws in bug bounty programs. The repository covers a wide range of attack categories including authentication bypass, cross-site scripting injection, server-side request forgery, web cache poisoning, and business logic abuse. It includes techniques for bypassing access co

ScribeJava is a Java library used to implement OAuth authentication and authorization flows. It functions as an OAuth client implementation and a third-party API integrator, allowing Java applications and Android environments to securely exchange data with external identity providers. The library provides a framework for managing secure data exchanges through pre-configured provider settings. It enables applications to link to external login services for user authentication and interaction with third-party APIs without requiring the local storage of passwords. The project covers identity pro

Swagger UI is an OpenAPI specification renderer and documentation interface that transforms JSON or YAML API definitions into a navigable, searchable website. It functions as an OpenAPI documentation UI and request client, providing a visual catalog for exploring endpoints and sending live HTTP requests to a server using a schema-defined interface. The project distinguishes itself through a plugin-based extension system and a schema-driven UI generation model. This architecture allows for the injection of custom components, state selectors, and helper functions to modify core behavior and lay