--- title: "When not to use theAuth: tools that fit better" description: "Cases where fosite, zitadel/oidc, goth, authboss, Keycloak, Ory, Better Auth or Auth.js is the better choice, each fact sourced and dated." canonical: https://theauth.dev/when-not-to-use/ lastmod: 2026-10-31 --- # When not to use theAuth theAuth fits when you want one MIT library for human sign-in and an OAuth 2.1 or MCP authorization server, inside your own process. If one of the cases below describes you, another tool fits better. Facts about other projects come from their own READMEs and the GitHub API, each with a link and the date we read it. Anything we could not verify is left out. Last verified: 2026-10-31 ## Reasons that come from theAuth itself - **You need a certification.** theAuth has no SOC 2, ISO or OpenID conformance certificate. See [security](https://theauth.dev/security/). - **You need a hosted service with a support contract.** The hosted option is in early access and has no published pricing or SLA. See [pricing](https://theauth.dev/pricing/). - **You need a long track record.** theauth-go was first committed on 2026-06-20 and one person writes nearly all of it. See the [Go status](https://theauth.dev/go/#go-status). - **You want no AI-agent features at all.** A narrower library will have less surface to review. ## Cases where another tool fits better For hosted vendors such as Auth0, Clerk or Stytch, see the [comparison pages](https://theauth.dev/compare/). ### Ory fosite (Go) **Pick it when:** you want a framework to assemble your own OAuth 2.0 and OpenID Connect provider and you accept writing the storage, login and consent code yourself. Its README describes it as an OAuth2 and OpenID Connect framework for Go, and points readers who want quick wins to Ory Hydra instead. The repository was created in December 2015 and is Apache-2.0 licensed. Source: [fosite README and repository metadata](https://github.com/ory/fosite), read 2026-10-31. ### zitadel/oidc (Go) **Pick it when:** you need an OpenID Connect relying party or provider library for Go and want one whose relying party has passed a conformance profile. Its README states that the relying party is certified for the basic and config profiles of OpenID Connect. theAuth makes no certification claim. The library is Apache-2.0 and was created in 2019. Source: [zitadel/oidc README](https://github.com/zitadel/oidc), read 2026-10-31. ### goth (Go) **Pick it when:** all you need is social login against many OAuth providers in a Go web app, with no sessions, passkeys or authorization server. Its README describes multi-provider authentication for Go and lists well over 50 providers, more than theAuth's 12 built-in login providers plus generic OIDC. It is MIT licensed and was created in 2014. Source: [goth README](https://github.com/markbates/goth), read 2026-10-31. ### authboss (Go) **Pick it when:** you run a server-rendered Go web app and want a modular, long-established set of auth features such as registration, confirmation and recovery. Its README calls it a modular authentication system for the web. It was created in January 2015, is MIT licensed, and was last released as v3.5.3 in November 2025. theAuth is newer: its repository dates from 2026-06-20. Source: [authboss README and releases](https://github.com/volatiletech/authboss), read 2026-10-31. ### Keycloak **Pick it when:** you need one central identity provider for many applications, with user federation and an admin console for non-developers. Its README describes open source identity and access management with user federation, strong authentication, user management and fine-grained authorization. It runs as a separate server under Apache-2.0, where theAuth is a library you embed. Source: [Keycloak README and license](https://github.com/keycloak/keycloak), read 2026-10-31. ### Ory Hydra and Kratos **Pick it when:** you want a standalone, certified OAuth 2.0 and OpenID Connect server (Hydra) or a standalone identity and user management service (Kratos) rather than a library inside your process. The Hydra README calls it a hardened, OpenID Certified OAuth 2.0 server and OpenID Connect provider that connects to your existing identity provider through a login and consent app. The Kratos README calls it an API first identity and user management system. Both are Apache-2.0. Source: [Ory Hydra README (Kratos README: github.com/ory/kratos)](https://github.com/ory/hydra), read 2026-10-31. ### Better Auth (TypeScript) **Pick it when:** you build in TypeScript and want the larger community and the broader plugin ecosystem. Its README describes a framework-agnostic authentication and authorization framework for TypeScript with a plugin ecosystem. It is MIT licensed and had 30,541 GitHub stars on 2026-10-31. See also the [side-by-side comparison](https://theauth.dev/compare/better-auth/). Source: [Better Auth README and GitHub API](https://github.com/better-auth/better-auth), read 2026-10-31. ### Auth.js **Pick it when:** you already run Auth.js and it works, or you need stateless sessions without a database. The Auth.js README now says Auth.js is part of Better Auth and recommends Better Auth for new projects unless there are specific feature gaps, most notably stateless session management without a database. If you are moving off Auth.js, the [migration page](https://theauth.dev/migrate/) lists what imports. Source: [Auth.js README](https://github.com/nextauthjs/next-auth), read 2026-10-31. Found something out of date? Use "Suggest a correction" in the footer. Stars, releases and licenses change, so check the linked source before deciding.