Keycloak
96 · HealthyIdentity and access management server with SSO, OIDC, SAML and user federation (CNCF).
Open source Auth & identity
authentik
88 · HealthyIdentity provider with flows, SSO across OIDC, SAML, LDAP and a proxy outpost.
Logto
86 · HealthyAuth and identity service for SaaS and AI apps, built on OIDC with organizations and RBAC.
ZITADEL
84 · HealthyMulti-tenant identity platform with event-sourced audit trail and B2B organizations.
Ory Kratos
79 · StableHeadless identity and user-management server with an API-first design.
Authelia
76 · StableSingle sign-on and two-factor portal that sits in front of web apps via a reverse proxy.
SuperTokens
74 · StableAuthentication backend with prebuilt UI, sessions and multi-tenancy.
Directory / Auth & identity / Keycloak
Keycloak
Identity and access management server with SSO, OIDC, SAML and user federation (CNCF).
Will it still be around?
Health 96/100 · Healthy
Activity, bus factor and issue responsiveness. Breakdown
Alternative to
Savings proposal
At 25 users, Okta costs about $150 a month and self-hosting Keycloak about $264, so Okta is cheaper at this size. Self-hosting pays off from 49 users.
List price: Okta Starter Suite, billed annually. SSO alone is $2 per user; most companies add adaptive MFA and lifecycle management ($14 to $17 per user). Minimum contract $1,500 a year. Source, checked 2026-10-07.
Extra cost over 3 years
$5,304
Pays for itself
Not at this size
Extra cost in year one
$2,568
Each month
$150 → $264
Show as a table
| Month | Okta | Self-hosted | Difference |
|---|---|---|---|
| Today | $0 | $1,200 | −$1,200 |
| Month 3 | $450 | $1,992 | −$1,542 |
| Month 6 | $900 | $2,784 | −$1,884 |
| Month 9 | $1,350 | $3,576 | −$2,226 |
| Month 12 | $1,800 | $4,368 | −$2,568 |
| Month 18 | $2,700 | $5,952 | −$3,252 |
| Month 24 | $3,600 | $7,536 | −$3,936 |
| Month 30 | $4,500 | $9,120 | −$4,620 |
| Month 36 | $5,400 | $10,704 | −$5,304 |
Assumptions you can change
Self-hosting Keycloak usually means an app server, a database and a cache or worker. Hours are for one engineer; the server cost is a typical cloud VPS with backups and grows with the number of people using it.
Not included: paid editions or features of Keycloak (see What's free?), large data migrations, and compliance work. All amounts in US dollars at list price; your negotiated price may differ.
Health score: 96/100
Activity45% weight
100/100
- Last commit today (100/100).
- 3190 commits in the past 12 months (100/100).
- 26 releases in the past 12 months (100/100).
Bus factor30% weight
100/100
- Top contributor wrote 14% of the last 100 commits (past 12 months).
- 39 people authored those commits.
Responsiveness25% weight
85/100
- 87% of all issues are closed (2698 open, 18032 closed) (95/100).
- 22 of 28 recent issues got a reply or were closed (79/100).
Score v2. How the health score works.
License
Apache License 2.0 · Open source (permissive)
OSI-approved license with few conditions beyond keeping the copyright notice.
Detected by GitHub as Apache-2.0.
What's free?
Enterprise features many open-core projects keep for paid plans.
| Feature | Self-hosted, free? |
|---|---|
| SSO (SAML) | Free |
| SSO (OIDC) | Free |
| SCIM provisioning | Unknown |
| Audit logs | Unknown |
| Role-based access control | Free |
| Multi-tenancy | Unknown |
GitHub metrics
| Stars | 37k | Forks | 9.0k |
|---|---|---|---|
| Last commit | today | Commits, 12 months | 3.2k |
| Releases, 12 months | 26 | Last release | 7 days ago |
| Contributors | 318 | Active authors | 39 in last 100 commits |
| Open issues | 2.7k | Closed issues | 18k |
Snapshot from 2026-10-08.