OpenID Connect, OAuth 2.0 and SAML identity provider on Workers, with a login UI for users and an admin UI for operators
- Deploy
- CLI
- License
- Apache-2.0
- GitHub stars
- 23 stars
- Last commit
Self-hosted alternatives to Amazon Cognito
Amazon Cognito is the AWS service for user sign-up, sign-in and federation that issues OAuth 2.0 and OpenID Connect tokens to applications. One listed app does its main job and runs in your own Cloudflare account.
Each answer comes from the app’s README and source code, compared with the features Amazon Cognito describes on its own site.
Amazon Cognito features, app by app
| Feature | Authrim |
|---|---|
| User pools with sign-up and sign-in | Yes |
| Managed login (hosted UI) | Yes |
| Federation with social, SAML and OIDC providers | Yes |
| MFA | Partly |
| OAuth 2.0 / OIDC token issuance | Yes |
| Lambda triggers to customize auth flows | Partly |
| User groups for authorization | Yes |
OpenID Connect, OAuth 2.0 and SAML identity provider on Workers, with a login UI for users and an admin UI for operators
- Who it suits
- Developers who need user pools and OIDC tokens for apps they host on Cloudflare rather than AWS.
- What a Amazon Cognito user would miss
- No AWS IAM identity pools or SMS, and you run and upgrade pre-1.0 code yourself.
- Yes User pools with sign-up and sign-in. Accounts stored in D1 with sign-up and login flows.
- Yes Managed login (hosted UI). Login UI Worker in 21 languages.
- Yes Federation with social, SAML and OIDC providers. External identity providers and a SAML service provider.
- Partly MFA. Passkeys and email codes; no SMS.
- Yes OAuth 2.0 / OIDC token issuance. Full OIDC and OAuth server, including PAR, DPoP and token exchange.
- Partly Lambda triggers to customize auth flows. Login flow definitions and plugins instead of arbitrary code hooks.
- Yes User groups for authorization. Roles plus role-, attribute- and relationship-based policies.