Casdoor
An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD
Last verified:
What is Casdoor?
Casdoor is an AI-Native Identity and Access Management (IAM) and Single-Sign-On (SSO) platform designed for the AI Agent era. It is an open-source solution with a UI-first approach, providing enterprise-grade authentication and authorization capabilities. The platform supports over 100 identity providers including OAuth 2.0, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, RADIUS, Google Workspace, Active Directory, and Kerberos.
Key features include a built-in MCP (Model Context Protocol) server with Streamable HTTP that lets AI agents manage Casdoor through natural language, OAuth 2.1 support for AI agents with Dynamic Client Registration and per-tool permissions, and comprehensive SaaS management capabilities with full billing support including plans, pricing tiers, and payment providers. Casdoor also features OpenClaw integration for LLM agent protection, collecting OpenTelemetry traces, metrics, and logs from LLM applications.
Casdoor is designed for development teams, enterprises, and organizations building applications that require secure authentication. It serves both web UI users and application login requests, making it suitable for B2B and B2C use cases. The platform is particularly valuable for teams building AI agents, SaaS applications needing subscription management, and organizations requiring high-concurrency authentication systems with horizontal scalability.
The platform follows a frontend-backend separation architecture developed in Golang with a JavaScript + React frontend, supporting high concurrency and localization in over 10 languages. It provides authorization management based on Casbin with support for ACL, RBAC, ABAC, and RESTful access control models, along with phone/email verification codes, password retrieval, access log auditing, and customizable registration/login pages.
Casdoor pricing
Pricing model: Freemium
Casdoor is open-source software under Apache-2.0 license, free to self-host. You only pay for VPS hosting (typically $5-20/month). There are no subscription fees or per-seat pricing for self-hosted deployments. The platform includes a SaaS management feature that allows organizations to define their own pricing plans, products, payments, and subscriptions for their applications. For managed/hosted options, there are tiered plans: Basic plan at $9/month supports up to 100,000 users and 20,000 monthly active users with OAuth/OIDC; Premium plan at $25/month adds SAML/CAS/LDAP, custom domains, up to 2 million users and 1 million monthly active users, 8-hour support; Enterprise plan at $59/month includes multi-region deployment, Azure AD and Google Workspace integration, and advanced security features. All plans include no extra charges per monthly active user.
Casdoor pros
- Open-source with Apache-2.0 license for free self-hosting
- Built-in MCP server for AI agent management via natural language
- OAuth 2.1 support specifically designed for AI agents
- Supports over 100 identity providers out of the box
- Comprehensive protocol support: OAuth 2.0, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, RADIUS
- UI-first approach with intuitive web-based management console
- Full SaaS billing capabilities with plans, pricing tiers, and payment providers
- Horizontal scalability for high concurrency scenarios
- Frontend-backend separation architecture built in Golang
- Supports ACL, RBAC, ABAC, and RESTful access control models via Casbin
- Localization in over 10 languages
- Customizable registration, login, and password retrieval pages
- OpenClaw integration for LLM agent protection and audit trails
- Phone verification codes, email verification codes, and password retrieval
- Database synchronization for smooth integration with existing systems
- Official SDKs available for multiple programming languages
- Supports mainstream databases: MySQL, PostgreSQL, SQL Server
- Anti-bot protection included in higher-tier plans
- Custom domain support for branding
- Access log auditing and recording functionality
Casdoor cons
- Documentation reportedly poorly written and badly translated from Chinese
- Requires minimum 512MB RAM, recommended 1024MB RAM for optimal performance
- Self-hosting requires VPS costs typically $5-20/month
- Initial setup requires manual configuration of organization, applications, and identity providers
- Default admin password '123' requires immediate change for security
- Steep learning curve for OAuth and identity management concepts
- Limited third-party support compared to commercial IAM solutions
- Some advanced features only available in paid tiers
- Plugin system for extending capabilities requires development expertise
- Cloud storage integration limited to Alibaba Cloud, Tencent Cloud, and Qiniu Cloud
Frequently asked questions about Casdoor
What is Casdoor?
Casdoor is an open-source UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform with web UI. It supports OAuth 2.0, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, RADIUS, Google Workspace, Active Directory, and Kerberos. It is designed for the AI Agent era with built-in MCP server support and OAuth 2.1 for AI agents.
Is Casdoor free to use?
Yes, Casdoor is open-source software under the Apache-2.0 license and is free to self-host. You only pay for your VPS hosting (typically $5-20/month). There are no subscription fees or per-seat pricing for self-hosted deployments. The platform can also function as a subscription and pricing system for your own SaaS applications.
What identity providers does Casdoor support?
Casdoor supports over 100 identity providers including GitHub, Google, QQ, WeChat, and many social networks and enterprise identity systems. It supports major protocols: OAuth 2.0, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, RADIUS, Google Workspace, Active Directory, and Kerberos. Custom authentication plugins can be developed for specialized requirements.
How does the MCP server work?
Casdoor's built-in MCP server with Streamable HTTP lets AI agents manage users, applications, and permissions through natural language. Every MCP tool call is authenticated and authorized with fine-grained, scope-based permissions. You can configure AI tools like Claude Desktop, Cursor, or any MCP-compatible client to connect to Casdoor's MCP endpoint using a Bearer token for authorization.
What databases does Casdoor support?
Casdoor supports mainstream databases including MySQL, PostgreSQL, and SQL Server. The platform also supports extending to new databases through plugins, allowing flexibility for different deployment requirements and existing infrastructure.
How do I integrate Casdoor with my application?
Integration is straightforward using Casdoor's OAuth 2.0 flow. Your application composes an authorization URL with client_id, response_type=code, redirect_uri, scope, and state parameters. After user authentication, Casdoor redirects back with a code that your application exchanges for an access_token. Casdoor provides official SDKs with complete features including identity authentication, user management, and resource uploads. Documentation on How to Connect to Casdoor provides quick start guidance.
What is OpenClaw and how does it work with Casdoor?
OpenClaw is an agent that collects OpenTelemetry traces, metrics, and logs from LLM applications and pushes them to Casdoor over OTLP. Every tool call, agent-to-agent interaction, and LLM invocation is recorded as a structured entry in Casdoor, providing a full audit trail of what agents actually did at runtime. Point OpenClaw at your Casdoor instance and traces appear immediately under Entries without extra infrastructure.
Can I customize the login and registration pages?
Yes, Casdoor allows full customization of registration, login, and password retrieval pages. You can customize the appearance and flow to match your brand requirements. The platform provides streamlined direct user registration where new users can sign up with Username, Display Name, Password, and Email, followed by email verification code confirmation.
What access control models does Casdoor support?
Casdoor supports authorization management based on Casbin with four access control models: ACL (Access Control List), RBAC (Role-Based Access Control), ABAC (Attribute-Based Access Control), and RESTful access control models. It also provides fine-grained permission control at the user account field level, allowing you to control who can view or modify specific user account fields through the Edit Organization page.
How do I recover a forgotten password?
Casdoor provides secure password recovery functionality. To reset your password, enter the username, email, or phone number associated with your account. You will receive a verification code via email or SMS. Simply enter the code along with your new password to complete the reset process. The platform supports both phone verification codes and email verification codes for this purpose.