Keycloak

What is Keycloak?

Single sign-on, social login, LDAP federation and authorization rules for your apps.

Who is Keycloak best for?

Keycloak is best for platform and security teams that need single sign-on across their apps on their own servers.

• One login across many apps

  Users sign in once for every connected app and sign out of all of them at once.

• Social and enterprise logins

  Social logins and existing OpenID Connect or SAML 2.0 providers are switched on in the admin console, with no change to app code.

• Companies on LDAP or Active Directory

  Built-in user federation connects to existing LDAP or Active Directory servers.

• Fine-grained permissions

  Authorization services define policies beyond simple roles, managed from the admin console.

How much does Keycloak cost?

Keycloak is free under Apache 2.0, with no paid tier or hosted plan from the project; you run it yourself on Docker, Kubernetes or a Java server.

Keycloak has no paid edition or hosted cloud from the project itself. Full pricing on github.com. We checked these prices on 8 Nov 2026.

How do readers rate Keycloak?

No one has rated Keycloak yet. Be the first.

Is Keycloak open source?

Yes. Keycloak's code is public under the Apache 2.0 licence, so you can run it on your own server.

Host it on a serverHostinger, DigitalOcean, Railway, Elestio and PikaPods set it up on a server for you with a one-click install.

Hosting with

What are the best Keycloak alternatives?

Keycloak is an open source alternative to WorkOS. Better Auth and authentik do the same job and are open source too.

WorkOSFree

Enterprise SSO, SCIM and audit logs for B2B apps.

Better AuthOpen Source

Authentication library for TypeScript apps with logins, 2FA, organisations and SSO in your code.

authentikOpen Source

Identity provider that handles logins, MFA, user directories and app access over SAML, OIDC and LDAP.

Questions about Keycloak