Self-host FusionAuth
1.70.0CIAM platform for auth, authorization, and user management
- Stars
- 240
- CPU
- t3.medium (2 vCPU) for 10-20 logins/sec
- RAM
- 512M minimum for FusionAuth app, 1-2GB for database, 1-2GB for Elasticsearch/OpenSearch
- Storage
- 10-50GB for compute node, 10GB+ for database, 10GB+ for Elasticsearch/OpenSearch
- Port
- 9011 (FusionAuth Admin UI and API)
- Requires
- PostgreSQL
fusionauth/fusionauth-appWhat is FusionAuth?
FusionAuth is a Customer Identity and Access Management (CIAM) platform that handles authentication, authorization, and user management for applications. It supports standards like OAuth2, OpenID Connect, SAML, and LDAP, along with modern features such as passkeys, WebAuthn, magic links, and breached password detection. The platform can be self-hosted using Docker, Docker Compose, or Kubernetes/Helm, requiring PostgreSQL and OpenSearch/Elasticsearch as dependencies. A free Community edition provides core authentication features, while paid plans (Starter, Essentials, Enterprise) unlock advanced security, connectivity, and support features. FusionAuth is developed by Inversoft, LLC (dba FusionAuth) and is proprietary software with a commercial license.
Should you self-host FusionAuth?
FusionAuth scores 49/100 on selfhost.directory (how scoring works) and ranks #23 of 40 in Authentication. It has 240 GitHub stars.
There was no stable release in the past 12 months, so check the repository's recent activity before you rely on it.
Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is Proprietary-licensed and written mostly in Dockerfile.
Its closest alternative on selfhost.directory is keycloak (86/100, 37 573 stars). It scores higher overall, so compare the two before you pick. See FusionAuth vs keycloak side by side.
Features
- Advanced Threat DetectionEnterprise plan only
- Breached Password DetectionPremium feature (Starter plan and above)
- LDAP IntegrationPremium feature (Starter plan and above)
- Magic Links
- Multi-factor authentication (MFA)
- OAuth2 / OpenID Connect provider
- Passkeys (WebAuthn)
- Passwordless Login
- Role-based Access Control
- SAML v2 IdP/SP
- Session Management
- Single Sign-On (SSO)
- Social Login
- User Registration
- Webhooks
FusionAuth README
FAQ
Does FusionAuth offer SLAs for self-hosted deployments?
No, FusionAuth does not provide SLAs for self-hosted deployments. SLAs (up to 99.99%) are only available for FusionAuth HA Cloud with Enterprise license.
Can I modify the FusionAuth source code?
No, the fusionauth-app bundle and closed-source libraries cannot be decompiled, reverse engineered, or modified. Only Apache 2.0 licensed components (docs, client libraries, examples) can be modified.
Can I run FusionAuth in an air-gapped environment?
Yes, since version 1.26 FusionAuth supports air-gapped licensed deployments. License can be installed via UI or API. Breached password detection requires network access.
Is FusionAuth open source?
No, the core fusionauth-app is proprietary/closed source. However, documentation, client libraries, JWT library, MVC framework, and domain objects are open source under Apache 2.0.
Can I use FusionAuth for free?
Yes, the Community plan is free and unlimited for internal use or your web/mobile applications. Paid plans unlock premium features, support, and hosting.
What does the FusionAuth license apply to?
The FusionAuth license applies to the fusionauth-app bundle used by all installation methods. The fusionauth-search bundle is vanilla ElasticSearch under its own license. Client libraries and example apps are typically Apache 2.0.
More in User Management
fusiondirectoryFusionDirectory is a self-hosted, open-source IAM solution for LDAP directories with role-based ACLs, workflow automation, and delegation for enterprises and education.
hankoOpen-source self-hosted authentication and user management platform with passkeys, MFA, OAuth SSO and SAML, an API-first alternative to Auth0 or Clerk.
jfa-goSelf-hosted, open-source user management for Jellyfin and Emby with invite-based accounts, password resets, and Ombi/Jellyseerr integration.
lamA self-hosted, open-source web frontend for managing users and groups in LDAP directories such as OpenLDAP and Active Directory.
LLDAPlldap is a self-hosted, open-source lightweight LDAP server with web UI, supporting SQLite/MySQL/PostgreSQL, simpler than OpenLDAP.
oryOpen-source, self-hosted identity server for login, registration, recovery and MFA, with passkeys, TOTP and social sign-in served through headless HTTP APIs.
Pocket IDSelf-hosted, open-source OpenID Connect Certified provider for homelabs and small teams that find Keycloak or Authentik too heavy; passkey sign-in only.
supertokensSelf-hosted, open-source authentication service replacing Auth0, Firebase Auth or AWS Cognito, with passwordless, social, email-password login and session management.
389-ds-base389 Directory Server is a self-hosted, open-source LDAP server for identity management with multi-supplier replication, TLS/SASL auth, and Active Directory sync.
authgearSelf-hosted open-source CIAM and identity provider, an Auth0/Clerk alternative with passkeys, MFA, SAML SSO and RBAC, deployed via Helm.
brightonumBrightonUM is a self-hosted, open-source auth service with REST API, JWT tokens, invite registration, email verification, and password recovery using MongoDB.
FreeIPAOpen-source, self-hosted identity management for Linux/UNIX networks: LDAP, MIT Kerberos SSO, certificate authority, DNS and AD trusts, with CLI, Web UI and API.
0 comments