Keycloak (self-hosted)
Open-source identity and access management (Apache-2.0), a CNCF project originally from Red Hat. SAML, OIDC, LDAP and MFA built in.
Organisations with the ops capacity to run their own identity server get enterprise SSO, MFA, LDAP/AD federation and custom themes with no per-user or per-connection fee. The bill is compute and Postgres: one 2 vCPU / 2-4 GB node suits a startup, while a 500k-MAU consumer app needs about 3 larger nodes. The real cost compared with hosted vendors is ops time for upgrades rather than licences. Commercial support is available as Red Hat build of Keycloak or from third-party hosting providers.
- Headquarters
- 🇺🇸 United States
- Parent jurisdiction
- 🇺🇸 United States (parent: Cloud Native Computing Foundation (Linux Foundation))
- EU self-serve plan
- Available; check eligible plans and regions
- GDPR DPA
- No / not documented
- Billing
- self-hosted
- Free tier
- Free and open source with no user or connection limits.
- Open source
- Yes · self-hostable
- Website
- www.keycloak.org
- Source last checked
- 2026-10-06
- Pricing evidence
- Operating cost not estimated
Pricing
Operating cost not estimated · servers, licenses and engineering time are yours. See notes for software editions and license terms.
Self-hosted: budget for infrastructure and maintenance. Enterprise SSO (SAML/OIDC identity brokering), MFA, LDAP/AD federation and custom themes are all included, with no per-connection fees. Rough sizing: a startup runs fine on one 2 vCPU / 2-4 GB node plus a small managed Postgres. A B2B SaaS with 20k MAU and dozens of IdPs wants two nodes for HA. A 500k-MAU consumer app needs about 3 nodes of 2-4 vCPU / 4-8 GB and a sized Postgres, plus ops time for upgrades. Data stays wherever you run it. Commercial support comes as Red Hat build of Keycloak (IBM) or from third-party hosting providers.
Managed alternatives
At 50K monthly active users, no enterprise SSO connections. Adjust usage and requirements.
Keycloak has no bill to estimate: you pay for the servers, storage and time to run it. Clerk is free at this usage, so running Keycloak yourself only makes sense for control or features, not cost.
- Clerk: $0/yr estimatedPublished rates
- Firebase Authentication / Google Identity Platform: $0/yr estimatedPublished rates
- Logto: $0/yr estimatedModeled ratesAssumes one access token per MAU per month; frequent token issuance increases cost. Paid feature add-ons are excluded.
- Supabase Auth: $0/yr estimatedPublished rates
- WorkOS: $0/yr estimatedPublished rates
No cheaper managed estimate matches your filters. Adjust your usage or compare with your actual contract bill.
The price difference leaves out migration costs, operating costs and any features you’d need to replace.
Self-hosted options
Operating cost is not estimated. These options are not counted as savings against managed services.
Compare Keycloak (self-hosted)
Migration guides
Found a wrong rate or plan restriction? Report a correction with a current source.