Keycloak
Keycloak is an open source identity and access management server that adds authentication and single sign-on to applications and services. It is a Cloud Native Computing Foundation incubation project and supports OpenID Connect, OAuth 2.0 and SAML 2.0. You run it yourself, so there is no per-user fee, but you also run the updates and the infrastructure.
Facts checked on against the sources listed at the end of this page.
- Pricing
- Open sourceFree plan: Yes: free to download and self-host, with no user limits
- Open source
- YesApache-2.0
A good fit for
- Teams that need single sign-on on their own servers
- Companies that must keep user data in their own infrastructure
- Apps that need to connect to LDAP, Active Directory or a SAML identity provider
- Large user bases where per-user pricing from hosted services would be expensive
Not a good fit for
- Small apps that want sign-in running in an afternoon: you host, upgrade and secure it yourself
- Teams that want a vendor to run it and answer support calls: the project itself does not sell a hosted service
- Apps that need prebuilt UI components in a specific frontend framework: Keycloak is a standalone server with its own login pages
Keycloak pricing
Keycloak is free software. There are no plans or per-user charges from the project, and your costs are the servers and the time to run it.
Prices in USD, checked on 14 October 2026. Current prices on keycloak.org.
Main features
- Single sign-on and sign-out
- Users sign in once and are signed out of all connected apps with one logout.
- Standard protocols
- OpenID Connect, OAuth 2.0 and SAML 2.0.
- Identity brokering and social login
- Sign in through social providers or other OpenID Connect and SAML 2.0 identity providers.
- User federation
- Connect existing user stores in LDAP or Active Directory.
- Admin and account consoles
- A web console for administrators and a separate one where users manage their own accounts.
- Authorization services
- Fine-grained authorization for protecting resources.
- Themes and extensions
- Custom themes, password policies, clustering and extension points.
About Keycloak
Keycloak moves sign-in out of your applications. Apps send users to Keycloak to log in, and Keycloak hands back a token over OpenID Connect, OAuth 2.0 or SAML 2.0. Logging out once ends the session across all connected apps.
It can act as an identity broker for social logins and for other OpenID Connect or SAML 2.0 identity providers, and it can federate users from LDAP or Active Directory. An admin console manages users and clients, and each user gets an account management console.
Keycloak is a Cloud Native Computing Foundation incubation project, and the project site credits the Keycloak Authors and the Linux Foundation. It is usually chosen by teams that need single sign-on on their own servers.
- Made by
- Keycloak Authors (CNCF incubation project)
- Launched
- 2014
- Free plan
- Yes: free to download and self-host, with no user limits
Keycloak alternatives
Questions about Keycloak
Is Keycloak free?
Yes. Keycloak is open source under the Apache-2.0 license and free to self-host with no user limits. You pay for the servers and the people who run it.
What protocols does Keycloak support?
OpenID Connect, OAuth 2.0 and SAML 2.0. It can also broker logins from other OpenID Connect and SAML 2.0 identity providers.
Who makes Keycloak?
Keycloak is a Cloud Native Computing Foundation incubation project. The project site credits the Keycloak Authors and the Linux Foundation.
Is there a hosted version of Keycloak?
The project publishes software to self-host and does not list a hosted plan on its site. Other companies offer managed Keycloak, with their own pricing.
Sources and links
Work on Keycloak? Claim this listing. Something wrong or out of date? Suggest a correction. Stats come from the public GitHub and npm APIs and update every day.