Open Source · Self-Hosted

Auth, billing, and payments

A self-hosted multi-tenant platform for small teams. Customize it with AI and skip the infrastructure.

Get StartedLive DemoView Features
terminal
$git clone https://github.com/timzaak/herald.git
$cd herald
$uv run scripts/dev-start.py
→ Starting PostgreSQL + Redis ...
✓ Database migrated
✓ Multi-tenant auth (RBAC, OAuth, TOTP)
✓ Subscription billing (Stripe, Creem)
✓ Admin console @ http://localhost:3000
→ Your auth & billing infrastructure is ready. Focus on your product.

Everything except your core product

Auth, billing, payments, user management — the stuff every SaaS needs but nobody wants to build. It's all here, AI-customizable, ready to deploy.

Multi-Tenant Auth

Organize users into isolated Realms with full data separation. Each Realm gets its own users, roles, OAuth providers, and Client Apps.

  • Realm-based tenant isolation
  • OAuth 2.0 provider (Google, GitHub, WeChat)
  • TOTP two-factor authentication

RBAC & Client Apps

Fine-grained role-based access control per Realm. Register Client Apps with OAuth 2.0 credentials and control which apps access which resources.

  • Role-based permissions per Realm
  • Client App registration & secrets
  • Third-party API integration

Billing & Payments

Create subscription plans, map them to payment providers, and assign plans to Client Apps. Includes points/credits and invoice management.

  • Subscription plans & pricing tiers
  • Stripe & Creem integration
  • Points & credits system

From zero to production in three steps

Deploy the platform. Let AI customize it. Ship your product.

01

Deploy with Docker

Clone the repo, point your domain, and run dev-start.py. PostgreSQL, Redis, Caddy (with auto-TLS), and the Herald app start together on one machine.

02

Customize with AI

Create Realms, set up OAuth providers (Google, GitHub, WeChat), configure RBAC roles. Use AI-assisted tools to tailor the platform without hand-writing infrastructure code.

03

Connect Your Apps

Your applications authenticate users through Herald's OAuth 2.0 endpoints. Users sign in with email/password or social logins. Herald handles sessions, tokens, and user management.

Why small teams choose Herald

Auth, billing, and payments in one self-hosted system. AI helps you customize. No stitching services together.

HeraldAuth0SupabaseKeycloak
Multi-tenant auth
Included
Enterprise onlyManual setupIncluded
Subscription billing
Built-in
———
Points & credits
Built-in
———
Self-hosted
Yes
Cloud onlyYesYes
Open source
Apache-2.0
NoPartialApache-2.0

Frequently asked questions

Everything you need to know about Herald.

What is Herald?
Herald is an open-source, self-hosted multi-tenant auth, billing, and payments platform. It ships with Realm-based tenant isolation, OAuth 2.0 providers, TOTP two-factor auth, RBAC, Client App management, subscription billing, and a points/credits system.
How is Herald different from Auth0 or Keycloak?
Herald combines authentication and billing in one self-hosted system with AI-assisted customization. Auth0 is cloud-only and charges per user. Keycloak is self-hosted but has no billing. Herald gives you multi-tenant auth plus subscription management, points/credits, and payment integration.
What does multi-tenant mean in Herald?
Multi-tenant means Herald organizes your users and data into isolated Realms. Each Realm is a separate tenant with its own users, OAuth providers, Client Apps, and billing plans. Data between Realms is fully isolated.
How do I deploy Herald?
Herald deploys with Docker. You need a Linux server (Ubuntu 22.04+, 2GB RAM), Docker Engine 24+, and a domain. Four containers run together: the Herald app, PostgreSQL, Redis, and Caddy.
What payment providers does Herald support?
Herald supports Stripe and Creem for subscription payments. You can create subscription plans with different pricing tiers, map plans to specific payment providers, and assign plans to Client Apps.
What tech stack does Herald use?
Herald uses Rust (Axum framework) for the backend API and React with TypeScript for the frontend. Data is stored in PostgreSQL with SeaORM, and Redis handles sessions and caching.
Is Herald free and open source?
Yes. Herald is released under the Apache-2.0 license. You can use, modify, and distribute it freely, including for commercial projects. There are no usage limits and no per-user fees.

Stop building infrastructure. Start shipping product.

Herald gives you auth, billing, payments, and user management out of the box. AI handles customization. You focus on what makes your software unique.

Star on GitHubRead Docs