FusionAuth is a company selling a self-hostable identity and authentication platform, and its blog covers OAuth, password hashing, and GDPR.
Commenters are split: some praise FusionAuth's APIs and self-hosting as a cheaper Auth0 alternative, while one calls its articles propaganda.
I do think it's pretty amazing that a basic modern authorization system essential has a hard dependency on a 20+ million lines of code web browser, even for native apps. And mostly just because we need a central location to store auth cookies. I'd love to see a stripped-down "auth browser" that has no job other than rendering basic style-free forms (maybe even declared in JSON) and storing cookies. Problem is you have to get the big boys to stop requiring JavaScript for their auth flows.
That said, after doing a decent amount of implementing OAuth2/OpenID Connect, the core profiles are actually pretty reasonable and about what you would want to do if you were starting from scratch. The trick is making sense of all the optional stuff. There have been some efforts[0] to improve that.
The part I've never been able to figure out is why does OAuth2 use tokens at all, rather than generating a key pair and sending the public key with the initial auth request, then signing subsequent requests?
[0]: https://fusionauth.io/articles/oauth/differences-between-oauth-2-oauth-2-1
Second time I have seen FusionAuth mentioned, so I figured I'd take a look.
Can you provide a link to the source? I can't seem to find it on their GitHub. They only appear to provide install scripts that grab the compiled java application off Google Storage.
Also, you can self-host, but you must agree to a somewhat restrictive license[1] upon install. As I read it, you can only self-host on equipment you own or operate (I don't own or operate EC2), can't deploy for anyone else (no use in consulting), are agreeing to random audits with 30-day notice, and can only use for "Licensee's internal business purposes" (so only auth for internal applications, not public-facing?). Even if these things aren't true, I don't feel comfortable that I understand what I can actually use this for with their current license.
[1]: https://fusionauth.io/license
Nice website! I like your docs too. Small tip though, the couple obviously AI-written articles (ostensibly for SEO purposes) in your footer are a little of a code smell.
Also design wise, the main logo item (vortex looking thingy) is a tad bit complex, maybe think about a redesign focused on making it more simple/recognizable. The rotating dashes on the landing page hero are a good motif though, so I'd lean into that.
Also noticed that on this page: https://fusionauth.io/tech-papers/winter-2026-g2-fusionauth-momentum-leader-customer-identity-and-access-management-ciam the form under "To get this tech paper complete the form below." doesn't load on Firefox with Enhanced Tracking Protection enabled. Disabling it causes the form to load though.
> I’m not aware of anyone running Caddy at any sort of scale for customers.
Well, to name a few...
- Stripe (https://twitter.com/caddyserver/status/1559591673511813120)
- Mercedes-Benz (https://github.com/caddyserver/caddy/pull/5275#issuecomment-1367478850)
- Approximated.app (https://dev.to/carterbryden/how-to-allow-end-user-custom-domains-in-your-app-4hm0)
- FusionAuth (https://fusionauth.io/blog/unlimited-domains-fusionauth)
The problem is those using Caddy are shy, not that it's not used at all. I know this because I see users removing the `server` header on the Caddy forum all the time, and many of the large users are just shy of their technology stack when it comes to Caddy.
Disclaimer: Member of the Caddy team
Frankly, your pricing also sucks. What you are telling me now is that to go from "testing" to "production", it is $37->$500.
I then click "Select" on $500 and it takes me to another page that is even more confusing. It lists a whole bunch more prices, no $500 price anymore and I have to go through the whole comparison again.
https://fusionauth.io/pricing?step=hosting -> https://fusionauth.io/pricing?step=plan&hosting=ha-cloud
None of this makes any sense. I'd go back to the drawing board. It is pretty astounding that this feedback hasn't been conveyed or managed before. Clearly a lot of effort has gone into what is presented and it really sets the tone for what working with your business would be like.
As someone who came from Auth0 and god-awful Amazon Cognito, we've been using FusionAuth for years. Their APIs and SDKs have been amazing to work with.
They even have a lambda feature to add additional logic around certain workflows or adding claims to your JWTs.
https://fusionauth.io
It does what Auth0 does but significantly more cheaper and you can also self-host if you want.
I built the Pulimi plugin for it which helps us easily configure it. If you don't use Terraform or Pulumi, they have this really cool kickstart feature where you can define a config file that will call their APIs on first time startup to set up the server. Really useful for local dev.