authentik's policies are Python run inside the server, and since 2025.10 it needs only Postgres. Expressiveness vs code-deploy rights, one store vs a ladder, and outposts.
Hydra has no login page: it hands the browser to your app across a documented protocol seam. What composable identity components buy you, and the seams you then own.
Both platforms are event-driven; they disagree about what an event is. Event sourcing vs event-carried state, Actions v2 moving code out of process, project grants, and AGPL.
FusionAuth runs JavaScript in the token path, but by default it can't make a network call. Why that line is in the right place, transactional webhooks, tenancy, and migration.
Cognito makes some decisions permanent at pool creation and keeps the password hashes. Lambda trigger budgets, multi-Region replication, identity pools, and the exit test applied to both.
Whatever issues your sessions is the most valuable thing you run or rent. Okta's integration network, three-second hooks, Agent SSO, and when Okta is the right workforce IdP.
Feature matrices converge; architectures don't. Four questions that actually separate Keycloak, Auth0, Entra, Ping and ClavionX, including when ClavionX is the wrong choice.
Every option in a mature federation server is a fossilized incident. What Ping's configuration depth and DaVinci orchestration buy you, and what they cost.
Entra is a directory first, with protocols attached. What that means for multi-tenant apps, the two-second claims callout, workload identity, and when to just use Entra.
Auth0 Actions let you run code at login; ClavionX refuses to. The 20-second kill switch, who decides fail-open, and when Auth0 is the better choice.
Keycloak made the extension model the product. What that costs at upgrade time, where its state lives, and when it beats a platform that runs no customer code.
A payments company I talked to spent most of a year building a proper authenticator-app enrolment flow. TOTP, recovery codes, a nice QR screen, copy reviewed by a writer. The security team had wanted SMS gone since the last pentest, and now there was a real alternative to move people