Updated October 26, 2026
· ~2 min read
There are two very different ways to "own" authentication. One is to run an identity server (Keycloak, Zitadel or Ory) that your applications talk to over OIDC, exactly as they would a hosted provider. The other is a library inside your own application and database (Better Auth, and Auth.js, which the Better Auth team now maintains) where users and sessions are simply tables you own.
Licences shifted here too: Zitadel moved from Apache 2.0 to AGPL 3.0 with its v3 release, offering a commercial licence for those who cannot accept it. Keycloak remains Apache 2.0 and a CNCF project, and Ory's core servers remain Apache 2.0.
Three reasons hold up. Very large user counts, where per-MAU pricing passes the cost of a small team. Data residency or sovereignty requirements a hosted provider cannot meet. And products where identity is part of the product — complex tenant hierarchies, unusual flows, deep integration with your own data model. "Avoiding lock-in" alone rarely is: a self-hosted identity server is its own lock-in, with an upgrade calendar attached.
Question 1 of 2
Is it one product with one database?
Use a library — Better Auth — when you have one product, one database and want users to be ordinary rows you can query, migrate and back up with everything else; it is the lightest way to own identity. Use Keycloak when you need a full identity server with every protocol and an enormous ecosystem, and can operate a Java application with care. Use Zitadel for a modern, multi-tenant identity server with a strong API, if AGPL or its commercial licence suits you. Use Ory when you want small, composable, API-first services and are comfortable assembling them. In every case you take on patching a security-critical system — budget for it as an ongoing cost, not a setup task.
We work with startups and growing companies on AWS architecture decisions. Tell us about your situation and we will recommend the right approach.
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.