Hanko

Unify passkeys with passwords, MFA, social login, and SAML instead of treating them as separate products

The official README lists passwords, MFA, passkeys, social logins, and SAML SSO, with configuration options such as passkey-only and OAuth-only. Hanko also covers user and session management plus JWT issuing, making it an API-first authentication platform rather than only a passkey widget.

Sources: [1]

Integrate ready-made Web Components or build a custom frontend on the SDK and API

Hanko Elements provides Web Components for login, onboarding, and user-profile flows, while the Hanko Frontend SDK handles communication with the Hanko API. The Elements npm package is MIT licensed, and the project positions the integration layer as framework-agnostic.

Sources: [1][4]

Use the Docker Compose quickstart to exercise frontend and backend together

The official quickstart clones the repository and starts deploy/docker-compose/quickstart.yaml with Docker Compose. Once running, the login experience is available at localhost:8888, with MailSlurper at localhost:8080 for testing email flows without your own SMTP server.

Sources: [2]

A strong fit for teams seeking an Auth0 or Clerk alternative with deployment control

Hanko is relevant not only for passkey-first applications, but also for products that need a gradual path from passwords, a shared layer for MFA and OAuth/SAML, or a self-hosted authentication API. Teams wanting the shortest UI integration can start with Hanko Elements, while teams building a custom experience can evaluate the frontend SDK and backend API directly.

The repository is mixed-license: backend and frontend integration packages have different obligations

The root LICENSE states that code outside frontend/elements and frontend/frontend-sdk is under AGPLv3, while those two directories use their own MIT licenses. The README also mentions non-copyleft commercial licensing on request. For self-hosting, modification, or hosted service use, evaluate the license of the specific components you deploy.

The quickstart is useful for evaluation, but it builds several services together. Production deployment should treat it as a reference rather than a ready-made production topology, and separately plan backend configuration, email delivery, OAuth/SAML connections, and session operations.

Sources: [3][1][2]