Self hosting Auth0: what does ZeroAuthy actually replace?

What is ZeroAuthy?

ZeroAuthy is a clean-room, Apache-2.0 identity server that speaks Auth0's Authentication API and Management API, published by the OccupySaaS collective on 14 October 2026. It is written in Go, ships as a single binary with the admin console compiled in, and stores users in memory, SQLite, PostgreSQL 14 or later, MySQL 8.0.17 or later, or an external gRPC plugin.

The pitch is unusually concrete: point an existing Auth0 SDK at a ZeroAuthy tenant domain and it should work unchanged. The maintainers say they test that against named client versions, and the repository names them: auth0-spa-js 2.28.3, auth0-react 2.28.2, nextjs-auth0 4.32.0, auth0-cli 1.37.0 and node-auth0 7.4.0. The OpenID Foundation certified the project for the Basic OP, Config OP and Form Post OP profiles at commit 38b4229, approved 30 October 2026.

GitHub's API put the repository at 203 stars and 14 forks on 3 November 2026, with the last push that morning. It is a three-week-old project with real traffic, not a manifesto with a logo.

Self hosting cost math: $11.99 a month against $240

Auth0's pricing page defaults to monthly billing and, at 500 monthly active users, shows three tiers: Free at $0, Essentials at $35 a month and Professional at $240 a month. Both paid prices are quoted at the 500 monthly active user setting in that calculator, while the free tier covers 25,000. Enterprise is a quote.

That shape matters more than the headline. You do not upgrade to Essentials or Professional for capacity, because the free plan already carries 50 times the paid starting setting. You upgrade for features like RBAC per organization, custom token exchange or M2M tokens, and at that point you are paying per head, roughly $0.48 per MAU on Professional at 500 users.

The self-hosted side has no licence fee and no user meter. The compute baseline that fits a small deployment is a budget VPS: Hostinger's KVM 1 lists at $6.49 a month on a 24-month term today and renews at $11.99, with 1 vCPU, 4 GB RAM and 50 GB NVMe. Annualised, Professional runs $2,880 and the VPS runs $143.88, a gap of $2,736 before anyone touches a server.

That gap is not profit. It is budget you redirect into operations: upgrades, backups, key rotation, incident response and the person who owns all of it. If nobody on the team wants that job, the cheaper number is fiction.

What the clone actually covers today

The compatibility matrix is the most useful page in the repository, because it separates what shipped from what is aspirational. Implemented and tested, per the project's own records:

• Discovery and JWKS, authorization code with PKCE, client credentials, password and password-realm grants, rotating refresh tokens with reuse detection, revocation and RP-initiated logout.
• Pushed authorization requests and the RFC 8628 device flow, verified against express-openid-connect 3.4.0 and Auth0.AuthenticationApi 7.49.0 respectively.
• Social connections (Google, generic OAuth2, back-channel OIDC), organizations with roles and invitations, application grants, discovery domains.
• Management API v2 for clients, resource servers, connections, users, roles, grants, tickets, import and export jobs, and email providers and templates, exercised with auth0-cli and node-auth0.
• Actions for login, credentials exchange, signup, password reset and custom email, plus attack protection and breached-password checks against a local corpus.
• Tenant logs, log streams, statistics and transactional event streams with webhook delivery and an SSE API.

Custom database connections run Auth0's script hooks in Node.js 22.13 or later, which is the piece that makes a migration plausible for apps storing credentials outside the identity provider.

Where it stops: SAML, passkeys and releases

Three gaps decide whether this is usable for you, and the landing page does not lead with them.

No enterprise SSO. The matrix lists SAML and WS-Federation as "Planned (sub-project 4)". Social OAuth and OIDC connections work, but SAML is the protocol most B2B buyers are actually paying Auth0 for. If your customers ask you to integrate their Okta or Entra ID tenant, this is not a replacement today.

MFA is partial. The Plan 33 record dated 2 November 2026 says OTP, verified-email codes and recovery codes are implemented and tested with an independent RFC 6238 generator. Push and Duo enforcement are listed as unavailable, WebAuthn and passkey flags are stored for a later plan, and phone, SMS and voice configuration is stored for Plan 34. MFA grants are implemented but withheld from discovery.

No releases. The GitHub releases endpoint returns an empty list, so there is no version to pin. You clone, build the console, compile the binary, then run migrations yourself. The matrix also records that Deploy CLI 9.1.0's provider export fails against its node-auth0 response handling, so the automated tenant-migration path is not finished.

ZeroAuthy vs Keycloak vs Zitadel

The realistic alternative for most teams is not another Auth0 lookalike, because none exists. It is a mature open-source identity provider, and the trade is compatibility for maturity.

• Keycloak is Apache-2.0, Java, 37,670 stars on GitHub, and supports SAML and OIDC out of the box. It is the safe, boring choice, but Auth0 SDKs do not talk to it without code changes.
• Zitadel is AGPL-3.0, Go, 15,502 stars, OIDC-first and lighter to run than Keycloak. The AGPL matters if you redistribute the product rather than host it internally.
• ZeroAuthy is the only one of the three chasing Auth0 API compatibility, so migration is mostly a base-URL change. You pay for that with a young codebase and no SLA.

If your auth code is deeply generic OIDC already, Keycloak or Zitadel will cost less over three years. If your app is written against Auth0 SDKs and the rewrite is the blocker, ZeroAuthy is the only option that removes it.

Who should self host this, and who should not

Reasonable fits: internal tools and side projects, teams already on Auth0 SDKs who want out of MAU billing, SMBs with no SAML requirement, and anyone who wants the user store on their own disk with Auth0 password hashes importable and upgraded to argon2id at sign-in.

Bad fits, for now: companies whose customers demand SAML, regulated buyers who need an SLA and an audit report, teams with no Go and Postgres operational experience, and anyone hoping to move a six-figure user base this quarter. The README calls the status "early" and the project is 20 days old. Treat it as a serious evaluation, not a cutover.

The Salesforce half is years behind the identity half

OccupySaaS launched two targets, and comparing them is the fastest way to calibrate the movement's timeline. SalesCompel, the Salesforce replacement, is Apache-2.0, has 173 stars, and last took a push on 21 October 2026.

Its README states that no full program milestone has a recorded exit-gate pass, and that the draft budget is roughly 185 to 350 additional plan equivalents through M9, its production-certification milestone. The Vue interface is a prototype running on synthetic data, with edits held in memory rather than sent to the backend.

Read the pair together and the pattern is clear: replicating an authentication API is a few weeks of focused work, replicating a CRM is a multi-year program. The identity project is worth watching now. The CRM one is worth bookmarking.

At a glance

Identity options checked 3 November 2026

FAQ

Is ZeroAuthy free to self host?

Yes. The code is Apache-2.0, there is no licence fee and no per-seat meter. Your costs are the server, backups and the engineering time to run it, and there is no managed tier to fall back on.

Can it replace Auth0 for enterprise SSO?

Not yet. SAML and WS-Federation are listed as planned in the project's compatibility matrix, while social OAuth, OIDC and database connections are implemented. Passkey and push MFA are also incomplete as of 3 November 2026.

Can I migrate an existing Auth0 tenant?

Partly. The Management API covers clients, APIs, connections, users, roles and jobs, and bulk import accepts Auth0 password hash formats, upgrading them to argon2id at sign-in. Automated export through Deploy CLI 9.1.0 fails in the project's own matrix, so expect to rebuild configuration by hand.

Related reading

Hostinger VPS pricing breakdown, managed vs self-hosted infrastructure, the real cost of self-hosted software

Sources

• OccupySaaS project site
• ZeroAuthy repository (GitHub)
• ZeroAuthy compatibility matrix
• SalesCompel repository (GitHub)
• Auth0 pricing
• Hostinger VPS pricing
• Keycloak repository (GitHub)
• Zitadel repository (GitHub)