# OccupySaaS ships ZeroAuthy 1.0 RC, a self-hosted Auth0 stand-in. What works, what doesn't, and the catch

> OccupySaaS describes itself as a group of laid-off engineers who use AI agents to clone paid SaaS from public docs. Its Auth0-compatible identity server reached release candidate 1 on November 4. It's Apache-2.0 and written in Go, and it already works with Auth0's own SDKs. The project says it isn't production-ready, and it isn't yet.

Published Nov 5, 2026 by TechMeasured Staff · Repos · Canonical: https://techmeasured.com/repos/occupysaas-zeroauthy-rc1-self-hosted-auth0-compatible-what-works

**OccupySaaS** says it is a group of laid-off engineers rebuilding paid software-as-a-service products as free, self-hostable code. On **November 4** it released **ZeroAuthy v1.0.0-rc.1**, the first release candidate of its Auth0-compatible identity server. ZeroAuthy is written in Go and licensed under **Apache-2.0**. It has a sibling project, **SalesCompel**, which aims to replace Salesforce. Both are built from public API documentation, with AI agents writing much of the code and humans reviewing every merge.

Why it matters: per-seat pricing is one of the biggest line items for small software companies. Login and identity are also a classic lock-in point. Moving off a hosted auth provider usually means rewriting client code. ZeroAuthy's pitch is different: keep your existing Auth0 SDK calls and point them at your own server. The project drew wide attention when a Hacker News thread about it passed **500 points and 300 comments** on November 2, according to the Zeli aggregator. This release candidate is the first build the project presents as something to try.

## What ZeroAuthy implements

According to the project site, ZeroAuthy "speaks the Auth0 APIs." The RC covers:

| Area | Status per OccupySaaS |
|---|---|
| Authentication API and hosted login | Implemented |
| MFA and passwordless | Listed as implemented in the RC |
| Management API and admin console | Implemented |
| OpenID conformance | Basic, Config and Form Post OP profiles certified |
| Storage | SQLite, PostgreSQL or MySQL |
| Tested clients | node-auth0, Auth0 CLI and Deploy CLI, auth0-react, nextjs-auth0 |
| Not yet supported | WebAuthn/passkeys, SAML, WS-Federation, enterprise directories, CIBA, JAR, token exchange |

The gaps are important. If your Auth0 tenant relies on SAML single sign-on, passkeys or a corporate directory connection, ZeroAuthy can't replace it today. The Daily Diff checked the OpenID Foundation's listing and says it records a specific ZeroAuthy commit for those three profiles. It also notes this is self-certification for protocol profiles only. It is not a security audit and doesn't prove full Auth0 parity. That review predates the RC and listed multi-factor sign-in as later roadmap work, so check the RC's compatibility notes before you count on MFA.

## SalesCompel is much earlier

The project site labels the Salesforce replacement "early, in progress." It has a Go/PostgreSQL core with persistent Account and Contact records, object `describe`, limited queries, external-ID upsert, bearer-token auth and an OpenAPI REST contract. It also ships an offline compatibility test lab. The Daily Diff warns that a separate Vue prototype uses only synthetic, in-memory data, so don't mistake it for the real backend. The same review says token lifecycle and public login are still future work. It adds that no full program milestone has passed its exit gate.

## How it's built

OccupySaaS calls its method "clean-room." Agents implement features from written specs drawn from public API docs, open standards and the behavior of vendors' public SDKs. Compatibility is then checked against those SDKs. The project's rules forbid using leaked code, decompiled binaries, a former employer's confidential information, and copied UI assets or trademarks. It says it isn't affiliated with Auth0, Okta or Salesforce. Its "occupation map" lists docs/wikis, issue tracking, feature flags, observability and customer support as proposed next targets. The site adds that these are open for discussion, not commitments.

## Try it, carefully

The site publishes a Docker image, `ghcr.io/occupysaas/zeroauthy:1.0.0-rc.1`. You need a master key and a bootstrap admin email to start it. The sample setup uses self-signed TLS, which the project says is for testing only. A sensible first test is to run it locally and point a staging app's existing Auth0 SDK config at it. Then check every login path you actually use before going further.

## The catch

- **Not production-ready, by its own account.** The OccupySaaS site says so plainly. The Daily Diff's verdict is "needs review."
- **Self-hosting moves the work to you.** One Hacker News commenter pointed out that customers pay SaaS vendors partly for backups and security updates. With a self-hosted identity server, both become your job, and auth is where mistakes hurt most.
- **Unverified backstory.** RuntimeWire and The Daily Diff both note that the layoff narrative comes from the project itself. Neither verified who the contributors are. Licensing is clear (Apache-2.0), but the project's own clean-room policy acknowledges contractual risk.

**Who should care:** small teams paying Auth0 per active user for plain OIDC login, and anyone who wants a local Auth0-compatible server for development and CI. Teams that need enterprise SSO should wait and track the compatibility matrix.


## Sources

1. [OccupySaaS — They laid us off. We're rebuilding their SaaS.](https://occupysaas.com/)
2. [RuntimeWire — OccupySaaS releases AI-built open-source replacements for Auth0 and Salesforce](https://runtimewire.com/article/occupysaas-zeroauthy-salescompel-auth0-salesforce)
3. [The Daily Diff — OccupySaaS: what the open-source Salesforce and Auth0 replacements implement](https://thedailydiff.dev/video/2026-11-02-occupysaas-rebuild/)
4. [Zeli (Hacker News) — Laid-off engineers are rebuilding Auth0 and Salesforce as free open-source clones](https://zeli.app/story/50331402)