Keycloak Alternatives

authentik is a self-hosted identity provider that speaks the same languages as Keycloak: OIDC, OAuth 2.0, SAML, LDAP, SCIM, RADIUS and a proxy mode for apps that have no login of their own. The free open source edition includes SAML, LDAP and SCIM, which is where many "open" alternatives start charging. Its login and enrollment journeys are built as flows and stages in the admin, so a passwordless or invitation-only signup is configuration, not a custom Java extension. The code outside the authentik/enterprise/ folder is MIT, which is even more permissive than Keycloak's Apache 2.0, but the enterprise folder carries its own licence.

How the price reads against Keycloak: both cost nothing to run yourself. authentik Enterprise is $5 per workforce user per month and $0.02 per customer account per month, billed annually, so 200 employees cost $12,000 a year and 50,000 customer accounts $1,000 a month. Billing counts every registered account, not monthly actives, so dormant customer accounts still cost $0.02 each. Enterprise adds the Google Workspace and Microsoft Entra ID integrations, mTLS and device trust; support tickets come only with subscriptions over $1k a year. Enterprise Plus starts at $20k a year, with FIPS compliance for FedRAMP. Tip: a homelab or a ten-person team rarely needs Enterprise. If you want it for support, note that 10 workforce seats ($600 a year) stay under the $1k line; 17 seats ($1,020 a year) is the smallest workforce plan that opens tickets.

Zitadel is an identity platform written in Go that treats organisations as first-class objects, which is the piece B2B SaaS teams struggle to model with Keycloak realms. You get OIDC, OAuth 2.0, SAML, passkeys, a full API and Terraform support, and you can run it on Zitadel Cloud or on your own infrastructure. Self-hosting needs a PostgreSQL database; for tests the docs say 1 CPU and 512MB of memory are more than enough, and for high availability they point to Kubernetes and an official Helm chart.

How the price reads against Keycloak: Zitadel Cloud Free costs US$0 a month and includes 100 daily active users, unlimited users and organisations and 3 identity providers. Pro costs US$100 a month ($1,200 a year) with 25,000 daily active users included and a custom domain; each extra 2,500 DAU adds $50. The Pro card shows a 1h response SLO, but Zitadel's detailed plan table gives Pro a 48-hour support SLO, with 1h as a paid add-on. Note the unit: Zitadel counts daily active users, not monthly ones, so compare it with an MAU price carefully. The licence changed with version 3 in 2025: the server is now GNU AGPL v3, while the proto definitions stay Apache 2.0 and the client packages are MIT. Self-hosting for your own login is fine under the AGPL, but if you modify the server and offer it to others over a network, the AGPL asks you to share your changes, or you buy the commercial licence.

FusionAuth is a customer identity server you can download and run, or rent as a hosted instance. FusionAuth Community is free and unlimited on your own infrastructure, and the comparison table lists SAML v2 and single sign-on in every plan, Community included. The API is the product: users, applications, tenants, themes and webhooks are all driven by REST, which suits teams that manage identity from code. One fact many guides get wrong: FusionAuth is not open source. Its licence agreement treats the software as proprietary, with a free tier you can download, so you cannot fork or patch the server the way you can with Keycloak.

How the price reads against Keycloak: Community costs nothing, like Keycloak. Hosting and premium features start with Starter, from $162 a month billed annually ($1,944 a year), which adds advanced MFA and application theming. Essentials starts at $240 a month billed annually and adds email support with a 24 to 48 hour response during business hours; Enterprise, with 24/7 support and high availability hosting, is on quote. Those are the prices at 1,000 MAU, the lowest setting of the pricing slider, and each one climbs with the MAU you select. Tip: price the support you need before the features you want, and move the slider to your real MAU before you compare.

Auth0 is the managed answer to the main reason people leave Keycloak: running it. There is no server, database or upgrade to own; you configure tenants, connections and Actions in a dashboard and call SDKs. The free plan covers up to 25,000 monthly active users, with 1 custom domain (credit card verification required) and 1 enterprise connection, so a first SAML customer fits in it. Auth0 reports over 99.99% monthly uptime for most regions, and it has a startup plan with 100K monthly external active users.

How the price reads against Keycloak: you swap infrastructure and staff time for a per-MAU bill. Paid plans are priced by MAU band: B2C Essentials starts at $35 a month and B2B Essentials at $150 a month, each for up to 500 monthly active users, and Professional starts at $240 (B2C) and $800 (B2B). The catch is the jump from Free to paid: the free plan holds 25,000 users, but the paid price you see is for 500, so a growing app that needs one paid feature pays for its whole MAU band. Tip: if business customers will sign in with SAML, price the B2B plans from day one. The Free plan includes 1 enterprise connection, but the paid B2C plans ask you to upgrade to B2B to keep enterprise connections, self-service SSO and SCIM, at $150 a month instead of $35 for 500 MAU. If you already run Auth0 and the MAU bill is why you are reading this, our guide to switching away from Auth0 covers the reverse move. Our Auth0 integration guide for Make shows how to push new signups to your other apps.

Ory splits what Keycloak does into separate services: Kratos for users and login, Hydra for OAuth 2.0 and OpenID Connect, Keto for permissions and Oathkeeper as an access proxy. Each runs on its own, so a team that only needs an OAuth 2.0 server can deploy Hydra alone. The open source projects use the Apache 2.0 licence, the same as Keycloak. You build your own login screens, which is freedom for a product team and work for an IT team.

Price check: self-hosting the open source services is free, but Ory positions that tier for evaluation and prototyping. SLA-backed CVE patching comes with the Continuous Security License and 24/7 SLA support with the Ory Enterprise License, both priced on quote. Ory Network, the managed version, has a free Developer plan, then Production at $770 a year (about $64 a month) with $21.00 of monthly credit, and Growth at $9,350 a year. Usage is billed per aDAU, $0.14 per aDAU per month on Production. Note that Growth lists B2B SSO as OIDC only, so check SAML before you plan an enterprise rollout on Ory Network. Tip: count your daily actives, not your sign-ups, because the meter is aDAU.

Okta is the commercial reference for workforce identity: employees sign in once and reach their SaaS apps, with MFA, lifecycle management and access governance sold as suites. If you run Keycloak mainly to give staff SSO into internal tools and SaaS, Okta replaces both the server and the team that maintains it. All Workforce Identity suites are billed annually. Starter begins at $6 per user per month, Core Essentials at $14 and Essentials at $17. For customer login, Okta Customer Identity starts with an Enterprise base platform at $3,000 per month, billed annually, with usage add-ons on top.

How the price reads against Keycloak: the trap is the floor. Okta Workforce Identity requires a $1,500 annual contract minimum, so a team under 21 employees pays more per head than the $6 list price (1,500 divided by $72 a year is 20.8 seats). On the customer side, $3,000 a month is $36,000 a year before any active user is billed, which rules Okta out for most apps that leave Keycloak to save money. The free Integrator plan is for building and testing only, with up to 10 monthly active users. Tip: if you need customer login from the Okta group, look at Auth0 above. Already on Okta and weighing an exit? Our Okta switching guide compares the options, and our Okta integration guide for n8n shows how to automate user onboarding and offboarding, as does our Okta integration for Zapier.

SuperTokens is an authentication layer for your own app, not a central identity provider for a whole company. Its SDKs render login inside your frontend and its core handles sessions, social login, passwordless, account linking and multi-tenancy. The core is Apache 2.0, except the ee/ folder, which has its own licence. You can let SuperTokens host the core or run it yourself. Paid features such as MFA and account linking are billed per MAU in either case.

How the price reads against Keycloak: the cloud is free under 5K monthly active users, then $0.02 per MAU. The first 5,000 are not a free allowance: the pricing calculator shows $100 a month at 5,000 MAU and $400 at 20,000, so every MAU is billed once you reach the threshold. The pricing page promises "No 10X surprise increases in price". The trap sits in the add-ons: MFA costs $0.01 per MAU with a minimum billing of $100 a month, so you pay $100 even below 10,000 MAU. Account linking ($0.005 per MAU) has the same $100 floor. Dashboard seats beyond the 3 free users cost $20 per user per month. Tip: if Keycloak also runs SSO into internal tools, SuperTokens does not replace that part.