--- source_url: "https://idenplane.com/?utm_source=openai" title: "Idenplane — Open-Source Self-Hosted IAM Server | Keycloak Alternative" mirrored_at: 2026-08-04T03:02:46.736Z host: idenplane.com cited_in_42a: true mirror_canonical: "https://index.42a.ai/idenplane.com/index__q__utm_source_openai" --- > **Original source:** https://idenplane.com/?utm_source=openai Idenplane is an AGPL-licensed identity server for teams that don't want a SaaS bill, a JVM, or vendor lock-in. Standards-compliant OAuth 2.0, OIDC, and SAML 2.0, with first-class SDKs for TypeScript, React, Next.js, iOS, and Android. [Quickstart](https://idenplane.com/docs/getting-started) [Star on GitHub —](https://github.com/idenplane/idenplane) Free, open source, and self-hosted — running in about 30 seconds. ![GitHub stars](https://img.shields.io/github/stars/idenplane/idenplane?style=flat&color=0e7490&logo=github&logoColor=white&label=stars)![Contributors](https://img.shields.io/github/contributors/idenplane/idenplane?style=flat&color=475569&label=contributors)![Latest release](https://img.shields.io/github/v/release/idenplane/idenplane?style=flat&color=15803d&label=release&include_prereleases)![License](https://img.shields.io/github/license/idenplane/idenplane?style=flat&color=64748b&label=license)![Last commit](https://img.shields.io/github/last-commit/idenplane/idenplane?style=flat&color=64748b&label=last%20commit) SDKs for R React N Next.js V Vue A Angular iOS iOS And Android TS TypeScript Built with N NestJS 11 R React 19 P PostgreSQL 16 TS TypeScript D Docker Pr Prisma 7 Re Redis K8 Kubernetes OAuth 2.0 OpenID Connect 1.0 SAML 2.0 PKCE (RFC 7636) TOTP (RFC 6238) WebAuthn / FIDO2 Device Auth (RFC 8628) Features ## What you get out of the box Everything you need to authenticate users and protect APIs — built on standards your auditors already know. Authentication & Security ### OAuth 2.0 + OpenID Connect Authorization Code with PKCE, Client Credentials, Device Authorization (RFC 8628), Refresh Token grants. OIDC Core 1.0 with discovery, backchannel logout, and session management. [Read the docs](https://idenplane.com/docs/oidc-guide) ### SAML 2.0 (IdP and SP) Act as Identity Provider or Service Provider. Issue and validate SAML assertions, broker external IdPs, exchange metadata, sign assertions — full enterprise SSO. [Read the docs](https://idenplane.com/docs/saml-guide) ### MFA, Passwordless and Step-Up TOTP authenticators, FIDO2/WebAuthn for hardware keys and biometrics, recovery codes, brute-force protection, and progressive ACR step-up for sensitive operations. [Read the docs](https://idenplane.com/docs) Identity ### Multi-Tenant Realms and Organizations Isolated realms with independent users, clients, signing keys, themes, and configurations. Org-level B2B teams, member invitations, and hierarchical roles for SaaS multi-tenancy. [Read the docs](https://idenplane.com/docs/configuration) ### Federation and Social Login Broker external OIDC and SAML identity providers — Google, GitHub, Microsoft, Apple, or any compliant IdP. LDAP/Active Directory sync, on-demand or scheduled imports. [Read the docs](https://idenplane.com/docs) ### Risk-Based Authentication Beta Score login attempts on signals like IP reputation, device posture, geo-velocity, and time-of-day. Trigger step-up MFA or block on threshold. APIs to plug in your own scoring. [Read the docs](https://idenplane.com/docs) Developer Platform ### Admin Console React 19 dashboard for realms, users, clients, roles, groups, sessions, and events. Per-realm theming, real-time updates, and full CRUD on every resource the API exposes. [Read the docs](https://idenplane.com/docs/getting-started) ### SDKs and CLI First-party SDKs for TypeScript, React, Next.js, Vue, Angular, iOS (Swift), and Android (Kotlin). Five lines to authenticate. A CLI for realm provisioning and CI workflows. [Read the docs](https://idenplane.com/docs/sdks/vue) Architecture ## One compact data-flow Requests flow top-to-bottom — client to protocol to engine to identity to data. Every layer is replaceable, every layer is observable. 1. ### Client Apps Your SPAs, servers, mobile apps and CLIs Your SPAs, servers, mobile apps and CLIs ReactNext.jsVue / AngulariOS / AndroidCLI / M2M 2. ### Protocol Layer Standards-compliant endpoints Standards-compliant endpoints OAuth 2.0 + PKCEOpenID Connect 1.0SAML 2.0Device AuthorizationJWKS / Discovery 3. ### Auth Engine Login flows, MFA and session management Login flows, MFA and session management Login FlowsMFA / WebAuthnStep-Up AuthRisk ScoringSSO Sessions \+ 3 more 4. ### Identity Core Resources, policies and federation Resources, policies and federation UsersRealmsRoles & GroupsOrganizationsFederation / LDAP \+ 4 more 5. ### Data & Infrastructure Persistent storage, cache and email Persistent storage, cache and email PostgreSQL 16MySQL 8+RedisLDAP / ADSMTP Observability (Prometheus metrics, audit events, structured Pino logs) attaches at every layer. [Read the architecture guide](https://idenplane.com/docs/architecture) Comparison ## Idenplane vs. the rest Honest comparison. Sources and dates linked below — open a PR if anything is outdated. Feature comparison between Idenplane, Keycloak, Auth0, Clerk, and SuperTokens as of 2026-05 Feature Idenplane Keycloak Auth0 Clerk SuperTokens Deployment Self-hosted (on your infra) [1](#cmp-fn-1) N/A N/A Hosted / managed option Open source Docker one-liner [1](#cmp-fn-1) N/A N/A Kubernetes / Helm [1](#cmp-fn-1) N/A N/A Horizontal scaling Protocols OAuth 2.0 + PKCE ~ [3](#cmp-fn-3) OpenID Connect 1.0 ~ [3](#cmp-fn-3) SAML 2.0 ~ [2](#cmp-fn-2) Device authorization Step-up authentication ~ ~ MFA & Passwordless TOTP (authenticator app) WebAuthn / FIDO2 Recovery codes Brute-force protection Identity Multi-tenant realms B2B organizations ~ ~ RBAC (roles & groups) LDAP / Active Directory Social & enterprise IdP Custom attributes ~ Developer Experience Modern admin console REST API Web SDKs (React / Vue / Angular) ~ Mobile SDKs (iOS / Android) ~ CLI tool Webhooks ~ Plugin / extension system ~ Operations Prometheus metrics Health-check endpoints Rate limiting ~ Audit logging Realm / tenant theming ~ Implementation language TypeScript Java N/A (SaaS) N/A (SaaS) TypeScript Idle memory baseline [4](#cmp-fn-4) ~150 MB JVM-bound N/A N/A ~200 MB Local-dev setup time [4](#cmp-fn-4) ~30 sec ~5 min ~2 min ~2 min ~5 min Official SDK count 10 2 10+ 5+ 4 Pricing model AGPL-licensed Apache 2.0 Freemium $$$ Freemium $$ Apache 2.0 + paid add-ons Full support Partial / paid tier Not applicable (SaaS) Not available 1. Auth0 and Clerk are managed SaaS — self-hosting is not an option, not an absence. Marked N/A in deployment rows. 2. Clerk SAML SSO and enterprise SSO connections require the Enterprise plan (clerk.com/pricing). 3. SuperTokens implements OAuth 2.0 / OIDC for select flows; coverage is more limited than Keycloak or Auth0 (supertokens.com). 4. Memory figures are idle baselines from internal smoke tests with a single realm and default config — not load-test results. Workload dictates real-world usage. Getting Started ## Local dev in 30 seconds Three commands to a working identity server. Production checklist included — don't ship the local config. Idenplane is running at `http://localhost:3000` Need more depth? [Read the full deployment guide →](https://idenplane.com/docs/deployment) Admin Console ## Powerful Admin Dashboard Full-featured React 19 admin console for managing realms, users, clients, roles, groups, sessions, identity providers, and audit logs — all in real time. Open Source No vendor lock-in. No surprise pricing. Fork it, extend it, self-host it. Your identity infrastructure, your rules. ![GitHub stars](https://img.shields.io/github/stars/idenplane/idenplane?style=for-the-badge&color=0e7490&logo=github&logoColor=white&label=stars)![Contributors](https://img.shields.io/github/contributors/idenplane/idenplane?style=for-the-badge&color=475569&label=contributors)![Latest release](https://img.shields.io/github/v/release/idenplane/idenplane?style=for-the-badge&color=15803d&label=release&include_prereleases)![Docker Hub pulls](https://img.shields.io/docker/pulls/islamawad/idenplane?style=for-the-badge&color=0e7490&logo=docker&logoColor=white&label=pulls)![License](https://img.shields.io/github/license/idenplane/idenplane?style=for-the-badge&color=64748b&label=license) ### Sponsor Idenplane on GitHub Recurring sponsorship funds maintenance, security fixes, and new SDKs. [Become a sponsor](https://github.com/sponsors/idenplane) ### How to contribute #### Report issues Found a bug? Open an issue on GitHub with reproduction steps. [Report a bug →](https://github.com/idenplane/idenplane/issues) #### Spread the word Star the repo, share on social, write about your experience with it. [Star on GitHub →](https://github.com/idenplane/idenplane) ### For developers Read the source, run the tests, integrate the SDK. ### For teams Deploy to your infrastructure and manage identity across all your applications. FAQ ## Things you'll actually ask The short, honest answers. ### Why not just use Keycloak? Keycloak is the right answer if you have a JVM team and want every IAM feature ever shipped. Idenplane targets a different point on the curve — a TypeScript codebase, a smaller memory footprint, modern SDKs, and a build/deploy story that fits a Node-shop CI. If you already run Java in production and need every Keycloak feature, stay on Keycloak. If you want a TypeScript stack with the protocols that actually matter, try Idenplane. ### Is Idenplane production-ready? Idenplane is at v1.0.0 with the OAuth 2.0, OIDC, SAML 2.0, MFA, WebAuthn, federation, and admin surface area you need to run authentication. It has not been third-party penetration-tested or independently audited. Use the comparison table to map what you need against what is in the box, run our suggested deployment, and decide for your own risk tolerance. "Production-ready" is a property of your deployment, not just the software. ### Who maintains it? Idenplane is maintained by a small open-source team led by the original author. The repository lives at github.com/idenplane/idenplane — issues, pull requests, and discussions are all public. There is no commercial entity behind it today, and no plans to relicense. ### How are CVEs and vulnerabilities handled? Report privately via [\[email protected\]](https://idenplane.com/cdn-cgi/l/email-protection) or by opening a GitHub Security Advisory at github.com/idenplane/idenplane/security/advisories/new. We aim to acknowledge within 72 hours, fix within 90 days, and coordinate disclosure with you. Fixes ship as patch releases; advisories are published on the GitHub Security tab once a fix is available. See our security.txt for the canonical contacts. ### What's the upgrade story? Idenplane follows semver. Patch (1.0.x) and minor (1.x.0) releases are backward-compatible and ship with the same image tag scheme. Database migrations run automatically on container start. Major releases (e.g. 2.0.0) document breaking changes in CHANGELOG.md and ship a migration guide. Pin a version tag in production and read the changelog before bumping. Have a question that isn't here? [Open a discussion on GitHub →](https://github.com/idenplane/idenplane/discussions)