verifier.org

Keycloak alternatives

13 tools we tested head to head against Keycloak, ranked — and what each one actually does differently.

last reviewed 17 aug 2026 · from our best 14 auth and identity providers ·list curated by Onur Ozcanxin

first — what you'd be leaving

Keycloak ranks #3 of 14 in our auth providers testing. the only one with no commercial layer anywhere.

85/100

every feature enterprises pay for elsewhere sits in the same apache 2.0 tree, with the entire operational burden as the price.

why people look for an alternative
  • scim is a preview feature, disabled by default
  • no first-party hosted tier — you run and patch all of it
  • operational burden is the real price and it is not small

stay with Keycloak if apache 2.0 with no commercial layer of any kind is the thing you care about most — nothing below beats it on that.

the short version
best alternativeClerkproduct teams who want the drop-in components and will not hit enterprise procurement for a while90/100best free optionBetter Authtypescript teams who want auth in their own codebase with no per-user bill ever80/100
advertisement
  1. 1

    Clerk

    #1 in auth providers · $25 a month at fifty thousand users, with one sso connection included

    90/100

    verdictthe cheapest credible option at mid-scale by a wide margin, priced per application rather than per account.

    Clerk vs Keycloak
     KeycloakClerk
    pricefree — self-host only$25/mo (pro)
    free tieryesyes
    cost at 50k mau$0 — infrastructure only$25/mo
    sso connectionincluded — no per-connection fee1 included, then $75/mo
    self-hostyes — apache 2.0no
    scimpreview, disabled by defaultnot published

    switch forproduct teams who want the drop-in components and will not hit enterprise procurement for a while

    pros
    • +$25/mo at 50,000 users — the cheapest credible option at that scale
    • +one enterprise sso connection included in the entry paid plan
    • +generous hobby tier at the same 50,000 user ceiling
    • +organisations included at 100 monthly active orgs before charges start
    • +drop-in ui components that cut integration to hours
    cons
    • priced per application, so multi-product companies pay repeatedly
    • logs retained 30 days even on the business tier
    • bills monthly retained users, a different unit from everyone else here
  2. 2

    WorkOS

    #2 in auth providers · free authentication to a million users, billed at the enterprise connection

    88/100

    verdictfree auth at any startup scale with enterprise features sold as clean line items — which become the entire bill as you land enterprise customers.

    WorkOS vs Keycloak
     KeycloakWorkOS
    pricefree — self-host only$125/connection/mo
    free tieryesyes
    cost at 50k mau$0 — infrastructure only$0 — free to 1m
    sso connectionincluded — no per-connection fee$125/mo each
    self-hostyes — apache 2.0no
    scimpreview, disabled by default$125/mo per connection

    switch forb2b saas selling to enterprises, where sso is a deal requirement rather than a feature

    pros
    • +authentication free to 1m monthly active users
    • +admin portal lets customers self-configure their idp
    • +sso and directory sync priced as clear per-connection line items
    • +connection pricing tiers down substantially at volume
    • +purpose-built for b2b rather than retrofitted from consumer auth
    cons
    • $125 per sso connection is the highest here, and scim is billed again
    • thirty enterprise customers on both costs roughly $6,000/mo
    • audit logs bill per streaming connection plus per million events
  3. 3

    Supabase Auth

    #4 in auth providers · auth bundled with the database you were already paying for

    82/100

    verdicteffectively free auth if you are already paying for the database, under a real mit licence — thin exactly where b2b requirements start.

    Supabase Auth vs Keycloak
     KeycloakSupabase Auth
    pricefree — self-host only$25/mo (pro plan)
    free tieryesyes
    cost at 50k mau$0 — infrastructure only$25/mo (pro plan)
    sso connectionincluded — no per-connection fee50 free, then $0.015/mau
    self-hostyes — apache 2.0yes — mit
    scimpreview, disabled by defaultnot documented

    switch forteams already on supabase who need solid consumer auth and little b2b machinery

    pros
    • +$25/mo covers auth plus the database, storage and functions
    • +mit licence on the auth server, verified from the licence file
    • +50,000 mau free, 100,000 included on pro
    • +saml 2.0 enterprise sso metered per user rather than per connection
    • +mfa via totp or phone documented
    cons
    • no documented scim provisioning
    • no end-user organisations or multi-tenancy model
    • auth audit logs not documented — treat as absent
    advertisement
  4. 4

    Better Auth

    #5 in auth providers · a plain mit framework with no metering at any scale

    80/100

    verdictthe only entry here where the code carries no commercial layer at all — and the only one you must operate entirely yourself.

    Better Auth vs Keycloak
     KeycloakBetter Auth
    pricefree — self-host onlyfree — the framework is not metered
    free tieryesyes
    cost at 50k mau$0 — infrastructure onlyn/a — not metered
    sso connectionincluded — no per-connection fee1 on $20 tier, then $50/mo
    self-hostyes — apache 2.0yes — mit
    scimpreview, disabled by defaultvia paid hosted service

    switch fortypescript teams who want auth in their own codebase with no per-user bill ever

    pros
    • +mit licence with no commercial restriction on the code
    • +no per-user metering at any scale
    • +auth lives in your codebase, on your database
    • +optional hosted tier is priced per event, so $20 holds at any user count
    • +the common destination for teams migrating off per-mau pricing
    cons
    • audit logs, sso management and directory sync require the paid hosted service
    • a library you operate — no vendor support path
    • organisations and multi-tenancy in the framework unconfirmed
  5. 5

    Logto

    #6 in auth providers · fifty thousand users free, then metered on tokens rather than people

    78/100

    verdictthe most generous published free tier here on a fully mpl-2.0 codebase, with a metering unit that quietly changes above it.

    Logto vs Keycloak
     KeycloakLogto
    pricefree — self-host only$24/mo (pro)
    free tieryesyes
    cost at 50k mau$0 — infrastructure only$0 — at the free ceiling
    sso connectionincluded — no per-connection fee$48 per connector
    self-hostyes — apache 2.0yes — mpl-2.0
    scimpreview, disabled by defaultnot published

    switch forsmall teams who want an open licence and a free tier that actually reaches production

    pros
    • +50,000 mau free — the most generous published free tier here
    • +mpl-2.0 across the codebase with no open-core split found
    • +$24 base is the cheapest paid entry of the open-source options
    • +only access tokens count toward the quota, not id or refresh tokens
    • +enterprise sso connectors at $48, well below workos
    cons
    • paid tier meters tokens rather than users, changing how you forecast
    • organizations, sso and m2m are separate add-ons stacked on the base
    • scim and audit logs not listed on the pricing page
  6. 6

    Descope

    #7 in auth providers · tenants, scim and audit logs in the free tier

    75/100

    verdictthe most complete b2b feature set at the bottom of the range, sold with an overage rate you cannot find.

    Descope vs Keycloak
     KeycloakDescope
    pricefree — self-host only$249/mo (pro)
    free tieryesyes
    cost at 50k mau$0 — infrastructure only≥$799 + unpublished rate
    sso connectionincluded — no per-connection fee3 free, 5 pro, 10 growth
    self-hostyes — apache 2.0no
    scimpreview, disabled by defaultincluded on all tiers

    switch forb2b products that need multi-tenancy and provisioning on day one

    pros
    • +scim provisioning included on every tier, including free
    • +tenants and multi-tenancy on all plans from free upward
    • +audit logs on every tier with retention as the only difference
    • +three enterprise sso connections on the free plan
    • +flows-based configuration rather than code-first integration
    cons
    • no per-mau overage rate published — cost above 25,000 users is unknowable
    • closed source with no self-hosting option
    • $249 entry price is high relative to what it includes
  7. 7

    Kinde

    #8 in auth providers · unlimited enterprise sso for less than one connection costs elsewhere

    73/100

    verdictthe cheapest enterprise sso in this ranking by a wide margin, held back by provisioning that has not shipped.

    Kinde vs Keycloak
     KeycloakKinde
    pricefree — self-host only$25/mo (pro)
    free tieryesyes
    cost at 50k mau$0 — infrastructure only$716.25/mo (pro)
    sso connectionincluded — no per-connection feeunlimited at $75/mo (plus)
    self-hostyes — apache 2.0no
    scimpreview, disabled by defaultcoming soon — not shipped

    switch forb2b teams landing many enterprise customers who each want their own idp

    pros
    • +unlimited enterprise sso connections at $75/mo on plus
    • +users on paid subscriptions are excluded from the mau count
    • +fifty organisations included on every paid plan
    • +10,500 mau included even on the $25 entry tier
    • +per-user rates decline across plans for high-volume products
    cons
    • scim is 'coming soon' on every plan, blocking enterprise procurement
    • $716/mo at 50,000 users is mid-table and well above clerk
    • audit log retention is one day on the free plan
  8. 8

    Firebase Authentication

    #9 in auth providers · free to fifty thousand users, on two price lists at once

    70/100

    verdictthe cheapest route to fifty thousand consumer users, wearing two price lists whose enterprise half we could not read.

    Firebase Authentication vs Keycloak
     KeycloakFirebase Authentication
    pricefree — self-host only$0 up to 50,000 mau
    free tieryesyes
    cost at 50k mau$0 — infrastructure only$0 — standard tier
    sso connectionincluded — no per-connection feeunverified — priced per mau
    self-hostyes — apache 2.0no
    scimpreview, disabled by defaultnot documented

    switch forconsumer mobile and web apps already inside the firebase ecosystem

    pros
    • +50,000 mau free on both spark and blaze
    • +deep integration with the rest of firebase and google cloud
    • +handles consumer identifiers — email, social, phone — out of the box
    • +no separate vendor if you are already on firebase
    • +the free tier is genuinely usable in production for consumer apps
    cons
    • one service on two price lists with different rates above the free tier
    • identity platform pricing tables would not render — enterprise rates unverified
    • enterprise saml and oidc users bill outside the free allowance
  9. 9

    SuperTokens

    #10 in auth providers · unlimited self-hosted users, with the b2b features licensed separately

    68/100

    verdictan unlimited-user open-source core with the open-core line running straight through the features b2b products need.

    SuperTokens vs Keycloak
     KeycloakSuperTokens
    pricefree — self-host only$0.02 per mau above 5,000, $100/mo minimum
    free tieryesyes
    cost at 50k mau$0 — infrastructure only$900 cloud / $0 self-host
    sso connectionincluded — no per-connection feeon request — enterprise licence
    self-hostyes — apache 2.0yes — apache 2.0 except ee/
    scimpreview, disabled by defaultnot published

    switch forteams who want unmetered self-hosted auth and do not need multi-tenancy

    pros
    • +self-hosted core has no mau limit — 50,000 users costs nothing
    • +apache 2.0 over everything outside the ee/ directory
    • +enterprise licence explicitly permits unlicensed dev and test use
    • +volume discounts published above 10,000 mau or five organisations
    • +first three dashboard users included
    cons
    • multi-tenancy, m2m and attack protection are priced on request only
    • mfa and account linking bill per mau even when self-hosted
    • $100/mo minimum applies per add-on, stacking fast
  10. 10

    AWS Cognito

    #11 in auth providers · the free tier was cut by 80% and most coverage hasn't noticed

    65/100

    verdictstill cheap if you pick the right tier on purpose, after a free-tier cut that makes most published comparisons wrong.

    AWS Cognito vs Keycloak
     KeycloakAWS Cognito
    pricefree — self-host only$0 up to 10,000 mau on lite or essentials
    free tieryesyes
    cost at 50k mau$0 — infrastructure only$220 lite / $600 essentials
    sso connectionincluded — no per-connection fee$0.015/mau above 50 free
    self-hostyes — apache 2.0no
    scimpreview, disabled by defaultnot documented

    switch forteams already deep in aws who will stay on the lite tier deliberately

    pros
    • +$220/mo at 50,000 users if you deliberately select the lite tier
    • +enterprise saml billed per user, not per connection — cheap at scale
    • +multi-tenancy documented with tenant isolation options
    • +inherits cloudtrail, cloudwatch and the aws iam apparatus
    • +pre-november-2024 pools keep the 50,000 mau free allowance
    cons
    • free tier cut from 50,000 to 10,000 mau for new pools
    • the default tier for new pools is essentials at nearly 3x lite
    • scim is not mentioned on the features page
+ 3 more tested, not detailed here
we ranked 14 auth providers in total. the 3 that didn't make this page are written up in the full ranking →

how these were compared

every tool on this page went through the same test as Keycloak — same tasks, same order, scored the same way. the comparison tables are the figures from that testing, not vendor spec sheets.

the auth providers test in full →
was this useful?