from Hacker News

Show HN: Tesseral – Open-Source Auth

by ucarion on 5/28/25, 3:27 PM with 86 comments

Hi folks! I'm Ulysse, and Tesseral (https://github.com/tesseral-labs/tesseral) is open-source auth for B2B SaaS.

Early in my career, I worked on enterprise auth and security features at Segment. I've been obsessed with the subtle details of enterprise software ever since. For example, I wrote an implementation of SAML in the early days of the COVID pandemic because I thought it was fun.

Over the years, I've felt frustrated that too few people have seemed interested in making auth obvious for developers of business software. Auth really doesn't need to be so confusing.

We made Tesseral to help software engineers get B2B auth exactly right – and focus their energy on building the features that users want.

You can use Tesseral to stand up a login page, authenticate your users, and manage their access to resources. Think of it like Auth0 or Clerk, but open source and built specifically for B2B apps. Among other things, that means that it’s designed for B2B multi-tenancy and includes enterprise-ready features like single sign-on (SAML SSO), multi-factor authentication (MFA), SCIM provisioning, and role-based access control (RBAC).

For those who expose public APIs, you can use Tesseral to manage API keys for your customers. You can even limit the scope of API keys to specific actions by using our RBAC feature.

We've taken care to make Tesseral powerful and secure enough to power real enterprise software but still leave it simple enough for any software developer to use. You don't have to be a security expert to implement Tesseral. (By default, therefore, Tesseral imposes a few opinions. Let us know if you have a good reason to do something unusual, and we'll work something out.)

If you want to experiment with Tesseral, you can host it yourself or use our hosted service. The hosted service lives at https://console.tesseral.com. You can find documentation here: https://tesseral.com/docs.

Here are a few simple demos:

https://www.youtube.com/watch?v=IhYPzz3vB54

https://www.youtube.com/watch?v=t-JJ8TNjqNU

https://www.youtube.com/watch?v=mwthBIRZO8k

We're in the early stages of the project, so we still have some gaps. We have more features, bug fixes, SDKs, and documentation on the way.

What have we missed? What can we do better? We're eager to hear from the community!

  • by satyrnein on 5/28/25, 6:19 PM

    From the docs:

    Users exclusively belong to Organizations; every User belongs to exactly one Organization.

    But I also see a screenshot where, after login, the User has to choose an organization or to create a new one. It seems to me that you support Users and Organizations in a many-to-many relationship, is that correct?

    At my work, we landed on the terminology of Users, Memberships, and Accounts to describe this (a User can have Memberships to multiple Accounts, an Account can have multiple Members, etc). As a result, you don't "delete a user", you "revoke a membership".

  • by nodesocket on 5/29/25, 4:14 AM

    I went back and forth deciding if I should use a service like auth0 / Clerk / Stack Auth for my Flask based app. Ultimately I decided on doing it myself. Storing users and organization in the SQLite db and using a Flask package like Flask-Login. I didn’t want to have to migrate to an ORM (SQLAlchemy) and needed a few basic constraints:

    - Users can optionally be assigned to an organization but not required.

    - Email address is globally unique.

    - A user can only be associated to a single organization.

    - 2FA support.

    - Single-Sign-On support with Google, Facebook, and GitHub.

    I have a feeling not using a framework or auth service is going to bite me in the butt down the line, but it just felt easier to roll my own implementation to start.

  • by tjko on 5/28/25, 5:21 PM

    Great demo videos -- looks like lots of strong design decisions! Will definitely try this in a future project.

    ... actually, given you already have a Golang SDK, I may try this very soon!

  • by grahamgooch on 5/29/25, 8:43 PM

    This is a very timely for us. We are close to pulling the trigger on KeyCloak.

    We also looked at Auth0 and Fusionauth - KeyCloak won.

    We did not check Teseral - could you help me understand why I would choose Tesseral over the other 3?

  • by cyberax on 5/28/25, 6:38 PM

    So you're competing with Auth0, Clerk and others. You really need some differentiator. For me that would be:

    - Service-to-service authentication.

    - User impersonation in S2S calls ("I'm a service SERVICE1 making a call on behalf of USER_JOE"), including for offline flows.

    - A way to view and manage the offline grants for S2S impersonation.

    - All of the above must be resilient.

    I don't think any authentication solution actually tackles this.

  • by d0100 on 5/29/25, 2:06 AM

    When Ory came out I was excited because they have a solid product that is made in Go, however their lack of multi-tenancy that didn't require setting up servers for each tenant made them a non-starter

    I just had to implement 2FA on our homegrown auth, and I can't wait to replace it with Tesseral

  • by chpatrick on 5/28/25, 4:11 PM

    How does it compare to Keycloak?

  • by aeneas_ory on 5/28/25, 7:26 PM

    Congrats on the launch Ulysse - impressive what you have been able to spin up with limited resources! Greetings from Ory :)

  • by ljm on 5/28/25, 5:43 PM

    It's a nice project but I don't think any venture needs a separate service for user accounts right off the bat. And I level that same criticism at Clerk, Auth0, Cognito which are all stand-ins for a lack of BE engineering.

    Rails + Devise + OmniAuth + Doorkeeper has kept me going for yeeeeeaaaaaarrrrrrs.

  • by danenania on 5/29/25, 2:02 PM

    Congrats guys—looking good!

    For the managed service, how do you think about the N+1 request/query issue and latency with things like org membership checks and authz checks? This always pushes me to want this stuff in my db or at least on my side of the network line. Seems that tesseral is self-hostable which is awesome and could be a solution, but I’d probably rather just use the managed service if it wasn’t for this issue.

  • by mooreds on 5/30/25, 1:36 PM

    Congrats on the launch! (From a FusionAuth employee!)

    Also, I interviewed Ned, the CEO of Tesseral, on my newsletter. You can read his thoughts about the future of CIAM here: https://ciamweekly.substack.com/p/an-interview-with-ned-olea...

  • by warthog on 5/29/25, 12:56 PM

    Seems python support is there. Would appreciate a Django walkthrough as well. Clerk, Betterauth and others mostly skip Django for some reason

  • by diqi on 5/28/25, 5:55 PM

    What's so different about auth for B2B?

  • by KaoruAoiShiho on 5/28/25, 6:08 PM

    How does it compare to the other recent YC company Stack Auth?

  • by hooverd on 5/28/25, 6:35 PM

    Does this compete with IDMs with Sailpoint?

  • by philbo on 5/29/25, 2:21 PM

    Have you had a pen test yet?

  • by vivzkestrel on 5/28/25, 5:32 PM

    keycloak, better-auth, supertokens and now this, i would love to know how it compares to the rest

  • by vanschelven on 5/28/25, 5:00 PM

    In the Django world I just ran into this project with similar goals:

    https://github.com/leukeleu/django-hidp

  • by _joel on 5/28/25, 4:09 PM

    Looks nice, we've been using https://zitadel.com/ and the journey to mutli-tennancy was fairly straight forward.

  • by macmac on 5/28/25, 3:52 PM

    This looks neat, unfortunately the dependency on AWS is a show stopper for many European companies these days.

  • by welder on 5/28/25, 4:08 PM

    I rolled my own auth [0] and it works just fine. Why do I need another service for Auth, it's simple enough already. I guess B2B products need more auth features so it's worth using a library?

    [0] https://github.com/wakatime/crackboard.dev/blob/main/package...