Compare
How QAuth compares
QAuth next to the identity platforms teams usually weigh, hosted and open source: on the points that matter once AI agents are involved, and on those where QAuth is still behind. Pick the products you want to compare.
Scroll sideways to see every product you picked.
| Hosted services | Open source | |||
|---|---|---|---|---|
| Feature | QAuth | Auth0 (Okta) | authentik | Keycloak |
| Open source | Yes Apache 2.0.[1] | No A proprietary service; only its client libraries are open source.[2] | Open core MIT; the enterprise part is source-available and needs a subscription in production.[7] | Yes Apache 2.0.[8] |
| Runs on your own servers | Yes With Docker Compose. Your users’ data stays on your servers.[1] | Yes Docker Compose, Kubernetes or AWS.[18] | Yes On servers, containers or Kubernetes.[19] | |
| Hosted service | Planned QAuth Cloud is planned, not available yet.[1] | Yes Shared public cloud, or a dedicated private cloud as an Enterprise add-on.[13] | No No hosted version is offered today.[23] | No No official hosted service; third parties offer hosting.[24] |
| Price | Free self-host Free on your own servers, with no per-user fees. QAuth Cloud, the hosted version, will be paid.[1] | Free tier Free up to 25,000 monthly active users; paid plans are priced by active users.[26] | Free self-host Enterprise is priced per workforce and per customer user.[23] | Free Paid support only inside Red Hat subscriptions.[24] |
| OAuth and OpenID Connect | Yes Complete OAuth 2.1 and OpenID Connect server. OpenID certification is planned before 1.0.[1] | Yes OAuth 2.0 and OpenID Connect. OpenID Certified in July 2026 (version 2026.8).[34] | ||
| AI agents acting for a person | Yes Token exchange names both the agent and the person, with capped access levels.[41] | Enterprise Token exchange since 2026.8; acting for a user needs Enterprise agent accounts.[48] | ||
| Sign-in for MCP servers | Yes Current MCP authorization profile (2026-07-28).[53] | Yes Auth for MCP, generally available since May 2026.[54] | Partly No MCP guide; dynamic registration needs a bearer token; CIMD not merged yet.[58] | Partly Official guide; newer MCP versions need experimental features.[59] |
| Person approves risky actions | Yes Step-up before dangerous operations, and an audit trail per agent.[41] | Paid add-on Asynchronous approval (CIBA) on Enterprise plans or as an add-on.[63] | Partly Can force a fresh sign-in; no step-up by assurance level and no CIBA.[69] | Yes Step-up authentication and CIBA approval.[70] |
| Post-quantum signatures | Opt-in Hybrid ML-DSA-65 signing, off by default.[74] | No No public plan found; documented algorithms are RS256, HS256 and PS256.[75] | Unreleased ML-DSA token signing merged on 5 November 2026, for the next release.[79] | Not yet Tracked in open issues, not in a release.[80] |
| EU Digital Identity Wallet sign-in | Built, opt-in Works with a test wallet; testing with real wallets is open.[74] | No Not documented; checks of US mobile driver’s licences are in early access.[84] | No Not available; a community proposal is open.[88] | Experimental Wallet sign-in (OID4VP) since 26.8.[37] |
| LDAP and Active Directory | Not yet Not in 1.0; planned for 1.x.[92] | Yes A connector on your network links Active Directory or LDAP; not an LDAP server.[93] | Yes LDAP and Active Directory as a source, and an LDAP server for apps.[97] | Yes Signs users in against and syncs from LDAP and Active Directory; not an LDAP server.[98] |
| SAML 2.0 | Not yet Not in 1.0; planned for 1.x, first as an identity provider.[92] | Yes SAML identity provider for apps, and SAML connections upstream (plan-limited).[102] | Yes SAML identity provider for apps, and SAML sources.[106] | Yes SAML identity provider for apps, and SAML identity providers upstream.[98] |
| SCIM user provisioning | Not yet Inbound SCIM comes with organizations in 1.x.[92] | Yes Inbound SCIM on enterprise connections; outbound through an Actions template.[110] | Yes SCIM in both directions.[113] | Yes Inbound SCIM since 26.8; no built-in outbound.[37] |
| Multi-factor sign-in | Yes TOTP, passkeys, recovery codes, Duo, SMS and email codes.[120] | Yes TOTP, security keys, passkeys and recovery codes, all free.[98] | ||
| Admin console | Yes The Auth0 Dashboard.[123] | Yes An admin interface for users, apps, flows and policies.[126] | Yes A built-in admin console.[98] | |
| Social and enterprise sign-in | Yes Google, Apple, GitHub and more on every plan; enterprise connections are plan-limited.[26] | Yes Google, Entra ID, Apple, GitHub and any OIDC or SAML provider.[132] | Yes Google, Microsoft, GitHub and more, plus any OIDC or SAML provider.[98] | |
| Who is behind it | QAuth Labs.[1] | Okta, Inc., San Francisco, USA.[136] | Authentik Security Inc., Pennsylvania, USA.[140] | |