# Casdoor

> Open-source IAM and SSO for customers, employees and AI agents: OIDC, SAML, LDAP, passkeys, MFA and OAuth for MCP servers. Self-host free or use Cloud from $24/month billed yearly.

Casdoor is open source under Apache-2.0. Casdoor Cloud is the managed version run by the Casdoor team: each customer gets a dedicated Casdoor instance and database, priced per instance with no per-user or per-MAU fees. Cloud and self-hosted run the same code, so customers can move between them.

## Casdoor Cloud pricing

Plans start at $24/month billed yearly. New accounts get $20 of free credit. Instances can run in 23 regions.

- Basic: $29/month, or $288/year (save 17%). For small teams getting started with a hosted Casdoor. Includes: Dedicated Casdoor instance and database; OAuth 2.0, OIDC, SAML, CAS, LDAP and SCIM; Your own subdomain at casdoor.com; Hosted in Singapore or Japan; Automatic Casdoor upgrades; No per-user or per-MAU fees; Support via tickets.
- Premium: $79/month, or $780/year (save 18%). For growing start-ups that need their own login domain. Includes: Everything in Basic; Custom domain with managed TLS certificate; Choose from 23 regions and switch any time; 8x5 technical support.
- Enterprise: $249/month, or $2388/year (save 20%). For companies running Casdoor in production. Includes: Everything in Premium; Priority 8x5 technical support; Help with onboarding and migration; Custom terms and invoicing on request.

- [Pricing](https://www.casdoor.com/pricing): Plans, what each includes, regions and pricing FAQ.
- [Cloud console](https://admin.casdoor.com): Sign up and create an instance.

## Use cases

- [Identity and access control for AI agents](https://www.casdoor.com/ai-agents): Make Casdoor the OAuth server for your MCP servers: AI clients register themselves and get tokens scoped to the tools a user approved. Open source.
- [Open-source single sign-on for every app](https://www.casdoor.com/sso): One login for every app: Casdoor is an open-source SSO server with OIDC, SAML, CAS, LDAP, RADIUS and Kerberos, plus MFA and single logout.
- [A SAML 2.0 identity provider you can self-host](https://www.casdoor.com/saml): Casdoor is an open-source SAML 2.0 IdP for AWS, Google Workspace and your own apps, and can also sign users in through Entra ID, Okta or ADFS.
- [LDAP, RADIUS and directory sync, built in](https://www.casdoor.com/ldap): Casdoor has a built-in LDAP server and RADIUS server for legacy apps, VPNs and Wi-Fi, and syncs users from Active Directory, Entra ID and Google Workspace.

## Comparisons

- [How Casdoor compares](https://www.casdoor.com/compare): Index of all comparison pages.
- [Casdoor vs Auth0](https://www.casdoor.com/compare/auth0): Compare Casdoor and Auth0: open source vs proprietary, self-hosted or managed, flat pricing from $24/month billed yearly vs per-MAU pricing, and how to migrate.
- [Casdoor vs Okta](https://www.casdoor.com/compare/okta): Compare Casdoor and Okta: one open-source platform for customers, employees and AI agents, self-hosted free or managed from $24/month billed yearly, versus per-user pricing.
- [Casdoor vs Keycloak](https://www.casdoor.com/compare/keycloak): Compare Casdoor and Keycloak, both Apache-2.0: protocols, built-in Casbin authorization, and a managed cloud from $24/month billed yearly so you don't have to run it.
- [Casdoor vs Clerk](https://www.casdoor.com/compare/clerk): Compare Casdoor and Clerk: open source vs proprietary, any stack vs React components, flat pricing from $24/month billed yearly vs per-user pricing.
- [Casdoor vs WorkOS](https://www.casdoor.com/compare/workos): Compare Casdoor and WorkOS for enterprise SSO and SCIM: no per-connection fees, open source and self-hostable, managed cloud from $24/month billed yearly.
- [Casdoor vs Stytch](https://www.casdoor.com/compare/stytch): Compare Casdoor and Stytch: open source vs proprietary APIs, hosted login and admin console, flat pricing from $24/month billed yearly vs per-MAU pricing.
- [Casdoor vs Descope](https://www.casdoor.com/compare/descope): Compare Casdoor and Descope: open source and self-hostable, no MAU caps or SSO connection limits, managed cloud from $24/month billed yearly.
- [Casdoor vs Kinde](https://www.casdoor.com/compare/kinde): Compare Casdoor and Kinde: open source and self-hostable vs proprietary, flat pricing from $24/month billed yearly vs base fee plus per-MAU overage.
- [Casdoor vs Amazon Cognito](https://www.casdoor.com/compare/cognito): Compare Casdoor and Amazon Cognito: open source and portable vs AWS-only, hosted login and admin console, flat pricing from $24/month billed yearly.
- [Casdoor vs Firebase Auth](https://www.casdoor.com/compare/firebase-auth): Compare Casdoor and Firebase Authentication: SAML, OIDC, MFA and multi-tenancy included, open source and self-hostable, cloud from $24/month billed yearly.
- [Casdoor vs Entra External ID](https://www.casdoor.com/compare/entra-external-id): Compare Casdoor and Microsoft Entra External ID, the successor to Azure AD B2C: open source, region choice, flat pricing from $24/month billed yearly.
- [Casdoor vs Supabase Auth](https://www.casdoor.com/compare/supabase-auth): Compare Casdoor and Supabase Auth: a standalone IdP for all your apps vs auth tied to a Supabase project, and Casdoor Cloud from $24/month billed yearly.
- [Casdoor vs FusionAuth](https://www.casdoor.com/compare/fusionauth): Compare Casdoor and FusionAuth: Apache-2.0 open source vs a free but closed Community edition, and managed hosting from $24/month billed yearly.
- [Casdoor vs Logto](https://www.casdoor.com/compare/logto): Compare Casdoor and Logto: Apache-2.0 vs MPL-2.0, protocols, which features are paid add-ons, and a dedicated managed instance from $24/month billed yearly.
- [Casdoor vs Zitadel](https://www.casdoor.com/compare/zitadel): Compare Casdoor and Zitadel: Apache-2.0 vs AGPL-3.0, flat pricing vs daily active users, and a dedicated managed instance from $24/month billed yearly.
- [Casdoor vs authentik](https://www.casdoor.com/compare/authentik): Compare Casdoor and authentik, two open-source IdPs with SAML, OIDC, LDAP and RADIUS: licensing, pricing, and a managed cloud from $24/month billed yearly.
- [Casdoor vs Ory](https://www.casdoor.com/compare/ory): Compare Casdoor and Ory: an all-in-one IAM with login pages and a console vs headless services you assemble; Casdoor Cloud from $24/month billed yearly.
- [Casdoor vs SuperTokens](https://www.casdoor.com/compare/supertokens): Compare Casdoor and SuperTokens: an SSO server for many apps vs auth embedded in one, MFA included, and a managed instance from $24/month billed yearly.
- [Casdoor vs Authelia](https://www.casdoor.com/compare/authelia): Compare Casdoor and Authelia: a full IAM with user management, SAML and sign-up vs a forward-auth portal; Casdoor Cloud from $24/month billed yearly.

## Integrations

- [Casdoor Marketplace](https://marketplace.casdoor.com): App integrations, identity provider templates and sign-in themes that Casdoor admins install from the console in one click, each with a setup guide.
- [App integrations](https://marketplace.casdoor.com/apps/): Step-by-step single sign-on with Casdoor for self-hosted apps such as Grafana, GitLab, Nextcloud, Vaultwarden and Argo CD.
- [Marketplace index](https://marketplace.casdoor.com/data/index.json): Machine-readable list of every integration.

## Blog

- [Top 5 Open-Source Descope Alternatives in 2026](https://www.casdoor.com/blog/descope-alternatives): Open-source alternatives to Descope without MAU or SSO connection caps: Casdoor, Keycloak, authentik, Logto and SuperTokens compared on pricing, login customization and enterprise SSO.
- [Top 5 Open-Source FusionAuth Alternatives in 2026](https://www.casdoor.com/blog/fusionauth-alternatives): Truly open-source alternatives to FusionAuth: Casdoor, Keycloak, Zitadel, authentik and Logto compared on license, which features are free, and managed hosting prices.
- [JWT vs Session Cookies: Which Should You Use for Authentication?](https://www.casdoor.com/blog/jwt-vs-session): Server-side sessions and JWTs compared: where state lives, revocation, scaling, security pitfalls, and why most apps end up using both, with sessions in the browser and JWTs for APIs.
- [OAuth 2.0 vs OpenID Connect (OIDC): The Difference Explained](https://www.casdoor.com/blog/oauth-vs-oidc): OAuth 2.0 is for authorization, OpenID Connect adds authentication on top. What each one gives you, access tokens vs ID tokens, which flow to use, and common mistakes.
- [Top 5 Open-Source Stytch Alternatives in 2026](https://www.casdoor.com/blog/stytch-alternatives): Open-source alternatives to Stytch for passwordless login and B2B SSO: Casdoor, SuperTokens, Ory, Logto and Supabase Auth compared on pricing, enterprise connections and how much UI you build yourself.
- [What Is CIAM? Customer Identity and Access Management Explained](https://www.casdoor.com/blog/what-is-ciam): CIAM explained: how customer identity differs from workforce IAM, the features a CIAM platform needs (sign-up, social login, passwordless, MFA, B2B organizations, consent), how vendors price it, and open-source options.
- [What Is SCIM? User Provisioning Explained, with Examples](https://www.casdoor.com/blog/what-is-scim): SCIM 2.0 explained: the standard API for creating, updating and removing users and groups across apps, how it works with SSO, example requests, and how to add SCIM provisioning to your app.
- [What Is Single Sign-On (SSO)? How It Works, Protocols and Benefits](https://www.casdoor.com/blog/what-is-sso): Single sign-on explained: how one login reaches many apps, the protocols behind it (OIDC, SAML, CAS, LDAP, Kerberos), workforce vs customer SSO, risks, and how to add SSO with an open-source identity provider.
- [Top 5 Zitadel Alternatives in 2026 (Apache-2.0 and MIT)](https://www.casdoor.com/blog/zitadel-alternatives): Alternatives to Zitadel with permissive licenses or different pricing: Casdoor, Keycloak, authentik, Logto and Ory compared on license, multi-tenancy, protocols and managed hosting.
- [Top 5 Amazon Cognito Alternatives in 2026 (Open Source and Managed)](https://www.casdoor.com/blog/aws-cognito-alternatives): Outgrowing Cognito's hosted UI, per-MAU pricing or AWS lock-in? Casdoor, Keycloak, Supabase Auth, Zitadel and Auth0 compared, and how to migrate users off Cognito.
- [Top 5 Open-Source Clerk Alternatives in 2026](https://www.casdoor.com/blog/clerk-alternatives): Open-source alternatives to Clerk for React, Next.js and everything else: Casdoor, Better Auth, Supabase Auth, Logto and SuperTokens compared on hosting, pricing and how they fit your app.
- [OAuth for AI Agents: OAuth 2.1, DPoP, Token Exchange and MCP](https://www.casdoor.com/blog/oauth-for-ai-agents): How AI agents and MCP clients get access tokens: OAuth 2.1 with PKCE, client ID metadata documents, resource indicators, DPoP, token exchange and the device flow, and what each one protects against.
- [Top 5 Open-Source Okta Alternatives in 2026](https://www.casdoor.com/blog/okta-alternatives): Self-hosted replacements for Okta Workforce Identity: Casdoor, Keycloak, authentik, Zitadel and Authelia compared on SSO protocols, directory sync, MFA and managed options.
- [6 Free and Open-Source SAML Identity Providers (2026)](https://www.casdoor.com/blog/open-source-saml-identity-providers): Self-hosted SAML 2.0 IdPs you can use for free: Casdoor, Keycloak, authentik, Zitadel, Shibboleth and SimpleSAMLphp compared on language, protocols, admin UI and managed options.
- [RADIUS vs LDAP: Differences and How They Work Together](https://www.casdoor.com/blog/radius-vs-ldap): LDAP is a directory you look users up in; RADIUS is a protocol network devices use to ask whether a user may connect. How each works, when you need both, and how to run them from one identity provider.
- [SAML vs OIDC: Differences, Flows and Which to Use](https://www.casdoor.com/blog/saml-vs-oidc): SAML and OpenID Connect both do single sign-on. How their flows, tokens and metadata differ, where each one is the right choice, and how one identity provider can serve both.
- [Single Logout Explained: OIDC RP-Initiated, Back-Channel and SAML SLO](https://www.casdoor.com/blog/single-logout): Why logging out of one app doesn't log you out of the others, and the standards that fix it: OIDC RP-initiated, front-channel and back-channel logout, SAML Single Logout, and token revocation.
- [What Is CAS (Central Authentication Service)? CAS SSO Explained](https://www.casdoor.com/blog/what-is-cas): CAS is a ticket-based single sign-on protocol, still common at universities. How a CAS login works, CAS 1.0 vs 2.0 vs 3.0, how it compares with SAML and OIDC, and which CAS servers you can use.
- [Auth Pricing Compared: Auth0, Clerk, Cognito & More (2026)](https://www.casdoor.com/blog/auth-pricing-comparison): How Auth0, Clerk, WorkOS, Amazon Cognito, Supabase, Zitadel and Casdoor charge for authentication, with a worked example at 100,000 monthly active users.
- [Top 10 Auth0 Alternatives in 2026 (Open Source & SaaS)](https://www.casdoor.com/blog/auth0-alternatives): Ten Auth0 alternatives compared on pricing model, free tier, open source and self-hosting: Casdoor, Clerk, WorkOS, Keycloak, FusionAuth, Logto, Zitadel and more.
- [Top 10 Open-Source IAM & SSO Solutions in 2026](https://www.casdoor.com/blog/best-open-source-iam): Casdoor, Keycloak, authentik, Zitadel, Ory and five more open-source identity providers compared: licenses, protocols, languages and who each one fits.
- [Casdoor vs Keycloak vs authentik vs Zitadel (2026)](https://www.casdoor.com/blog/casdoor-vs-keycloak-vs-authentik-vs-zitadel): A side-by-side comparison of the four most popular self-hostable identity providers: license, stack, protocols, authorization, multi-tenancy and managed hosting.
- [Top 5 Managed Identity Providers with No Per-User Fees](https://www.casdoor.com/blog/dedicated-managed-identity-providers): Most auth SaaS bills per monthly active user on shared infrastructure. These five give you your own instance at a flat price: Casdoor Cloud, Skycloak, Phase Two, Cloud-IAM and FusionAuth.
- [Top 5 Keycloak Alternatives in 2026](https://www.casdoor.com/blog/keycloak-alternatives): Lighter, easier or managed alternatives to Keycloak: Casdoor, authentik, Zitadel, Ory and FusionAuth compared, plus where to get Keycloak hosted if you want to keep it.
- [Top 5 OAuth Providers for MCP Servers and AI Agents (2026)](https://www.casdoor.com/blog/mcp-authorization-servers): Which identity providers can secure remote MCP servers under the 2026 MCP authorization spec: WorkOS, Casdoor, Auth0, Descope and Keycloak compared.

## Open-source Casdoor

- [Documentation](https://casdoor.ai/docs/overview): Installation, configuration, protocols, providers and SDKs. A full index for AI assistants is at https://casdoor.ai/llms.txt.
- [Try with Docker](https://casdoor.ai/docs/basic/try-with-docker): Run Casdoor locally in one command.
- [Source code](https://github.com/casdoor/casdoor): Casdoor on GitHub.
- [Live demo](https://demo.casdoor.com): A writable demo instance that resets every few minutes.

## Contact

- Sales and migrations: https://tawk.to/casbin
- Support: support@casbin.com