OpenCIAM
OpenCIAM is an open-source customer identity platform for handling sign-in, single sign-on, consent, and user management.
What OpenCIAM is
OpenCIAM is an open-source customer identity platform for handling sign-in, single sign-on, consent, and user management. It supports OAuth 2.1, OpenID Connect, SAML 2.0, passkeys, magic links, email and SMS one-time passwords, and push approval. Risk-based MFA can use device, geographic, velocity, and behavior signals to request additional authentication. The platform lists more than 30 connectors, including Google, Apple, Microsoft, and GitHub, plus enterprise federation and SCIM provisioning. User-management tools cover profiles, roles, organizations, permissions, self-service registration, and progressive profiling. Privacy features include consent management, data-residency controls, audit trails, and data export and erasure. Developers can use typed SDKs, REST and GraphQL APIs, and event webhooks or actions. Community is Apache-2.0 licensed, self-hosted, and has no monthly active user limit. Its free Cloud plan covers up to 7,500 monthly active users, then uses usage-based pricing; paid Enterprise pricing is custom.
Good
- Supports passkeys, magic links, OTP, and push approval
- Risk-based MFA uses multiple signal types
- 30+ listed prebuilt connectors
- Community edition has no monthly active user limit
- Self-hosting supports air-gapped environments
Watch out
- Cloud usage-based pricing applies above 7,500 MAU
- Enterprise pricing is custom and not listed
- Community support is through Discord and GitHub
Who it suits
OpenCIAM suits teams building customer sign-in and consent flows, especially those needing multiple authentication methods or user-management controls. Its self-hosted and air-gapped options may suit teams with deployment and data-residency requirements.
Verdict
OpenCIAM combines a broad set of sign-in methods with user, consent, and privacy management. The choice between its free self-hosted Community edition and Cloud depends on deployment preference and expected usage.
Plans and prices
From OpenCIAM's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Cloud | Free | Everything in Community · 99.99% SLA & global edge · Automatic upgrades & backups · SOC 2 / ISO 27001 infrastructure · Email & chat support · Migrate to self-host anytime · $0; up to 7,500 MAU, then usage-based |
| Community | Free | Unlimited monthly active users · All auth methods & passkeys · SSO, social & enterprise login · Visual flow builder · Consent & GDPR tooling · Community support (Discord & GitHub) · Free; self-hosted, forever |
| Enterprise | Priced on request | Self-host or dedicated cloud · Dedicated or air-gapped deployment · Data residency & BYO-KMS · SAML, SCIM & advanced ReBAC · Priority SLA & 24/7 support · Security review & DPA · Solution architect & onboarding · Custom |
The facts
Each one read from OpenCIAM's own pages, with the date it was checked.
What it does
- Adaptive MFA
- Risk-based step-up authentication uses device, geographic, velocity, and behavior signals.checked 4 Oct 2026
- Authentication
- It supports OAuth 2.1, OpenID Connect, SAML 2.0, FIDO2/WebAuthn passkeys, magic links, email and SMS OTP, and push approval.checked 4 Oct 2026
- Cloud service
- The managed cloud plan lists a 99.99% SLA, global edge, automatic upgrades and backups, and SOC 2 / ISO 27001 infrastructure.checked 4 Oct 2026
- Consent and privacy
- Consent features include GDPR/CCPA-ready management, data residency controls, audit trails, and one-click data export and erasure.checked 4 Oct 2026
- Deployment
- Self-hosted deployments can use Docker, Helm, or Kubernetes, run on Postgres, and support air-gapped environments.checked 4 Oct 2026
- Developer tools
- OpenCIAM provides typed SDKs, REST and GraphQL APIs, and event webhooks/actions.checked 4 Oct 2026
- Integrations
- The platform lists 30+ prebuilt connectors, including Google, Apple, Microsoft, and GitHub, plus enterprise SAML/OIDC federation and SCIM provisioning.checked 4 Oct 2026
- Intended users
- The Enterprise plan is described for regulated teams needing scale and control, with dedicated or air-gapped deployment and data residency options.checked 4 Oct 2026
- License and limits
- The self-hosted Community edition is Apache-2.0 licensed and has no monthly active user limit.checked 4 Oct 2026
- Product
- OpenCIAM is an open-source customer identity platform for SSO, passwordless login, passkeys, MFA, social login, and consent.checked 4 Oct 2026
- Security
- Listed security controls include refresh-token rotation with reuse detection, breached-password and credential-stuffing screening, encryption, fine-grained access controls, and immutable exportable audit logs.checked 4 Oct 2026
- Support
- Community support is provided through Discord and GitHub; Cloud lists email and chat support, while Enterprise lists priority SLA and 24/7 support.checked 4 Oct 2026
- User management
- User management includes profiles, roles, organizations, RBAC and ReBAC permissions, self-service registration, and progressive profiling.checked 4 Oct 2026
Alternatives to OpenCIAM
- 1
Authgear
Free planOpen sourceAndroidiOSWebAPI8.5From $50 a month - 2
Ory
Free planOpen sourceWebAPILinuxmacOS8.4From $770 a year - 3
FusionAuth
Free planAndroidiOSWebAPI8.3From $162 a month - 4
Google Cloud Identity
Free planAndroidiOSWebAPI8.3Free plan - 5
cidaas
Free planAndroidiOSWebAPI8.1Free plan - 6
Descope
Free planAndroidiOSWebAPI7.6From $249 a month