The Open Source Login That Ends the SSO Tax

Every app you have ever used had to answer one question before anything else: who are you. Authentication is the front door of software, and it is the one part almost nobody wants to build twice. So most teams do the sensible thing and rent it. They hand the front door to a provider, wire in a login button, and get on with their lives. Then the invoice arrives, and it turns out the front door is priced by the number of people walking through it, which means the cost climbs at exactly the same rate as your success. Login is one of the quietest, most expensive taxes in software.

VoidAuth is what happens when someone decides not to pay it.

What VoidAuth actually is

VoidAuth is an open source single sign-on server for everything you self-host. You run it once, on your own box, and it becomes the single login for all your other apps. The tagline is exactly as ambitious as it sounds: single sign-on for your self-hosted universe.

Concretely, it speaks the two languages that let it stand in front of almost anything. It is a full OpenID Connect provider, so any app with a “log in with” button can point at VoidAuth instead of Google or Okta. And it does ForwardAuth, the trick where your reverse proxy, Caddy or Traefik or nginx, quietly checks with VoidAuth before it lets a request through, which means you can put a real login in front of apps that have no proper auth of their own. Point Nextcloud, Immich, Grafana, Jellyfin, and Portainer at it and they suddenly share one account and one login screen.

And it is not a weekend toy. VoidAuth ships an LDAP directory server, user and group management, self-registration and invites, multi-factor authentication, passkeys, and passkey-only accounts, secure password resets with email verification, and encryption at rest on either Postgres or SQLite. You can paint the whole thing your own color, with your own logo, title, and email templates. It runs from a Docker Compose file, it is AGPL licensed, and it has quietly collected a couple of thousand GitHub stars from people who decided their front door should belong to them.

The tax it cancels

To feel the size of the thing it is refusing to pay, look at what login costs when you buy it. Okta, the public identity giant, paid six and a half billion dollars for Auth0, the developer login service best known for a bill that swells as your user count grows. WorkOS, which sells companies the enterprise flavor of single sign-on, raised at a two billion dollar valuation on exactly that premise: charge per connection for the login features big customers are required to have. Clerk, another modern login-as-a-service, was last valued at one and three-quarter billion. These are enormous companies built on a simple truth, that authentication is tedious to build and easy to charge for.

The most telling part has a nickname the industry uses without irony: the SSO tax. Single sign-on, the basic ability to let a team log in with one managed account, is routinely locked behind the priciest tier a vendor sells, or metered per user so that securing your company properly costs more the more you grow. VoidAuth’s reply to the SSO tax is to turn single sign-on into something you run, once, for as many people as you want, at the price of the little server it lives on.

It is a crowded, healthy corner

VoidAuth is not alone in this, and that is the good news rather than the bad. Open source identity is one of the most mature neighborhoods in all of self-hosting. Keycloak, backed by Red Hat, is the heavyweight that enterprises reach for. Authentik and Authelia have devoted followings among people who run their own servers, and Zitadel, Ory, and Pocket ID each own a slice. VoidAuth’s pitch inside that crowd is approachability: more capable than a proxy-only gate, far less of a mountain than Keycloak, with passkeys and a clean setup built in from the start. When a category has this many credible free options, the question stops being whether an open source version exists and becomes which one fits your weekend.

The catch

Now the honest part, because authentication is the one place where honesty matters most. This is the most security-critical service you will ever choose to self-host, and running it yourself means carrying that weight. If VoidAuth goes down, you are not locked out of one app, you are locked out of everything sitting behind it, so uptime and backups stop being nice-to-haves. Auth is also the thing attackers want most, which makes keeping it patched a standing job rather than a someday. And the paid providers are not only selling software. They are selling audited security teams, compliance certifications, and the deep comfort of having someone else to phone at 3am when nobody can log in. For a company of any real size that comfort is worth serious money, which is precisely why it costs so much.

This is the fourth time in this little series the pattern has held. First it was dictation and meeting notes, then the deploy platform and the inbox, then the CRM, and now the front door itself, the login layer that three separate billion dollar companies are built on top of. We keep writing these at AppClap for the same reason we build AppClap in the first place: the tool that actually fits your job is, more and more, the free and open one that a few stubborn people put on the internet, and it deserves to sit in the results next to the names with the advertising budgets. The reaper we have been joking about since the first post has reached the entrance of the house now, scythe leaning on the doorframe. So before you rent your own front door, it is worth thirty seconds on the question this whole series keeps circling. Has somebody already built this in the open and handed you the keys? More and more, the answer is yes.