home / rankings / auth providers / keycloak alternatives Keycloak alternatives 13 tools we tested head to head against Keycloak, ranked — and what each one actually does differently.
last reviewed 17 aug 2026 · from our best 14 auth and identity providers · list curated by Onur Ozcan x in
first — what you'd be leaving Keycloak ranks #3 of 14 in our auth providers testing. the only one with no commercial layer anywhere.
85 /100 every feature enterprises pay for elsewhere sits in the same apache 2.0 tree, with the entire operational burden as the price.
why people look for an alternative
− scim is a preview feature, disabled by default − no first-party hosted tier — you run and patch all of it − operational burden is the real price and it is not small stay with Keycloak if apache 2.0 with no commercial layer of any kind is the thing you care about most — nothing below beats it on that.
advertisement
1
Clerk #1 in auth providers · $25 a month at fifty thousand users, with one sso connection included
90 /100 verdict the cheapest credible option at mid-scale by a wide margin, priced per application rather than per account.
Clerk vs Keycloak
Keycloak Clerk price free — self-host only $25/mo (pro) free tier yes yes cost at 50k mau $0 — infrastructure only $25/mo sso connection included — no per-connection fee 1 included, then $75/mo self-host yes — apache 2.0 no scim preview, disabled by default not published
switch for product teams who want the drop-in components and will not hit enterprise procurement for a while
pros
+ $25/mo at 50,000 users — the cheapest credible option at that scale + one enterprise sso connection included in the entry paid plan + generous hobby tier at the same 50,000 user ceiling + organisations included at 100 monthly active orgs before charges start + drop-in ui components that cut integration to hours cons
− priced per application, so multi-product companies pay repeatedly − logs retained 30 days even on the business tier − bills monthly retained users, a different unit from everyone else here 2
WorkOS #2 in auth providers · free authentication to a million users, billed at the enterprise connection
88 /100 verdict free auth at any startup scale with enterprise features sold as clean line items — which become the entire bill as you land enterprise customers.
WorkOS vs Keycloak
Keycloak WorkOS price free — self-host only $125/connection/mo free tier yes yes cost at 50k mau $0 — infrastructure only $0 — free to 1m sso connection included — no per-connection fee $125/mo each self-host yes — apache 2.0 no scim preview, disabled by default $125/mo per connection
switch for b2b saas selling to enterprises, where sso is a deal requirement rather than a feature
pros
+ authentication free to 1m monthly active users + admin portal lets customers self-configure their idp + sso and directory sync priced as clear per-connection line items + connection pricing tiers down substantially at volume + purpose-built for b2b rather than retrofitted from consumer auth cons
− $125 per sso connection is the highest here, and scim is billed again − thirty enterprise customers on both costs roughly $6,000/mo − audit logs bill per streaming connection plus per million events 3
Supabase Auth #4 in auth providers · auth bundled with the database you were already paying for
82 /100 verdict effectively free auth if you are already paying for the database, under a real mit licence — thin exactly where b2b requirements start.
Supabase Auth vs Keycloak
Keycloak Supabase Auth price free — self-host only $25/mo (pro plan) free tier yes yes cost at 50k mau $0 — infrastructure only $25/mo (pro plan) sso connection included — no per-connection fee 50 free, then $0.015/mau self-host yes — apache 2.0 yes — mit scim preview, disabled by default not documented
switch for teams already on supabase who need solid consumer auth and little b2b machinery
pros
+ $25/mo covers auth plus the database, storage and functions + mit licence on the auth server, verified from the licence file + 50,000 mau free, 100,000 included on pro + saml 2.0 enterprise sso metered per user rather than per connection + mfa via totp or phone documented cons
− no documented scim provisioning − no end-user organisations or multi-tenancy model − auth audit logs not documented — treat as absent advertisement
4
Better Auth #5 in auth providers · a plain mit framework with no metering at any scale
80 /100 verdict the only entry here where the code carries no commercial layer at all — and the only one you must operate entirely yourself.
Better Auth vs Keycloak
Keycloak Better Auth price free — self-host only free — the framework is not metered free tier yes yes cost at 50k mau $0 — infrastructure only n/a — not metered sso connection included — no per-connection fee 1 on $20 tier, then $50/mo self-host yes — apache 2.0 yes — mit scim preview, disabled by default via paid hosted service
switch for typescript teams who want auth in their own codebase with no per-user bill ever
pros
+ mit licence with no commercial restriction on the code + no per-user metering at any scale + auth lives in your codebase, on your database + optional hosted tier is priced per event, so $20 holds at any user count + the common destination for teams migrating off per-mau pricing cons
− audit logs, sso management and directory sync require the paid hosted service − a library you operate — no vendor support path − organisations and multi-tenancy in the framework unconfirmed 5
Logto #6 in auth providers · fifty thousand users free, then metered on tokens rather than people
78 /100 verdict the most generous published free tier here on a fully mpl-2.0 codebase, with a metering unit that quietly changes above it.
Logto vs Keycloak
Keycloak Logto price free — self-host only $24/mo (pro) free tier yes yes cost at 50k mau $0 — infrastructure only $0 — at the free ceiling sso connection included — no per-connection fee $48 per connector self-host yes — apache 2.0 yes — mpl-2.0 scim preview, disabled by default not published
switch for small teams who want an open licence and a free tier that actually reaches production
pros
+ 50,000 mau free — the most generous published free tier here + mpl-2.0 across the codebase with no open-core split found + $24 base is the cheapest paid entry of the open-source options + only access tokens count toward the quota, not id or refresh tokens + enterprise sso connectors at $48, well below workos cons
− paid tier meters tokens rather than users, changing how you forecast − organizations, sso and m2m are separate add-ons stacked on the base − scim and audit logs not listed on the pricing page 6
Descope #7 in auth providers · tenants, scim and audit logs in the free tier
75 /100 verdict the most complete b2b feature set at the bottom of the range, sold with an overage rate you cannot find.
Descope vs Keycloak
Keycloak Descope price free — self-host only $249/mo (pro) free tier yes yes cost at 50k mau $0 — infrastructure only ≥$799 + unpublished rate sso connection included — no per-connection fee 3 free, 5 pro, 10 growth self-host yes — apache 2.0 no scim preview, disabled by default included on all tiers
switch for b2b products that need multi-tenancy and provisioning on day one
pros
+ scim provisioning included on every tier, including free + tenants and multi-tenancy on all plans from free upward + audit logs on every tier with retention as the only difference + three enterprise sso connections on the free plan + flows-based configuration rather than code-first integration cons
− no per-mau overage rate published — cost above 25,000 users is unknowable − closed source with no self-hosting option − $249 entry price is high relative to what it includes 7
Kinde #8 in auth providers · unlimited enterprise sso for less than one connection costs elsewhere
73 /100 verdict the cheapest enterprise sso in this ranking by a wide margin, held back by provisioning that has not shipped.
Kinde vs Keycloak
Keycloak Kinde price free — self-host only $25/mo (pro) free tier yes yes cost at 50k mau $0 — infrastructure only $716.25/mo (pro) sso connection included — no per-connection fee unlimited at $75/mo (plus) self-host yes — apache 2.0 no scim preview, disabled by default coming soon — not shipped
switch for b2b teams landing many enterprise customers who each want their own idp
pros
+ unlimited enterprise sso connections at $75/mo on plus + users on paid subscriptions are excluded from the mau count + fifty organisations included on every paid plan + 10,500 mau included even on the $25 entry tier + per-user rates decline across plans for high-volume products cons
− scim is 'coming soon' on every plan, blocking enterprise procurement − $716/mo at 50,000 users is mid-table and well above clerk − audit log retention is one day on the free plan 8
Firebase Authentication #9 in auth providers · free to fifty thousand users, on two price lists at once
70 /100 verdict the cheapest route to fifty thousand consumer users, wearing two price lists whose enterprise half we could not read.
Firebase Authentication vs Keycloak
Keycloak Firebase Authentication price free — self-host only $0 up to 50,000 mau free tier yes yes cost at 50k mau $0 — infrastructure only $0 — standard tier sso connection included — no per-connection fee unverified — priced per mau self-host yes — apache 2.0 no scim preview, disabled by default not documented
switch for consumer mobile and web apps already inside the firebase ecosystem
pros
+ 50,000 mau free on both spark and blaze + deep integration with the rest of firebase and google cloud + handles consumer identifiers — email, social, phone — out of the box + no separate vendor if you are already on firebase + the free tier is genuinely usable in production for consumer apps cons
− one service on two price lists with different rates above the free tier − identity platform pricing tables would not render — enterprise rates unverified − enterprise saml and oidc users bill outside the free allowance 9
SuperTokens #10 in auth providers · unlimited self-hosted users, with the b2b features licensed separately
68 /100 verdict an unlimited-user open-source core with the open-core line running straight through the features b2b products need.
SuperTokens vs Keycloak
Keycloak SuperTokens price free — self-host only $0.02 per mau above 5,000, $100/mo minimum free tier yes yes cost at 50k mau $0 — infrastructure only $900 cloud / $0 self-host sso connection included — no per-connection fee on request — enterprise licence self-host yes — apache 2.0 yes — apache 2.0 except ee/ scim preview, disabled by default not published
switch for teams who want unmetered self-hosted auth and do not need multi-tenancy
pros
+ self-hosted core has no mau limit — 50,000 users costs nothing + apache 2.0 over everything outside the ee/ directory + enterprise licence explicitly permits unlicensed dev and test use + volume discounts published above 10,000 mau or five organisations + first three dashboard users included cons
− multi-tenancy, m2m and attack protection are priced on request only − mfa and account linking bill per mau even when self-hosted − $100/mo minimum applies per add-on, stacking fast 10
AWS Cognito #11 in auth providers · the free tier was cut by 80% and most coverage hasn't noticed
65 /100 verdict still cheap if you pick the right tier on purpose, after a free-tier cut that makes most published comparisons wrong.
AWS Cognito vs Keycloak
Keycloak AWS Cognito price free — self-host only $0 up to 10,000 mau on lite or essentials free tier yes yes cost at 50k mau $0 — infrastructure only $220 lite / $600 essentials sso connection included — no per-connection fee $0.015/mau above 50 free self-host yes — apache 2.0 no scim preview, disabled by default not documented
switch for teams already deep in aws who will stay on the lite tier deliberately
pros
+ $220/mo at 50,000 users if you deliberately select the lite tier + enterprise saml billed per user, not per connection — cheap at scale + multi-tenancy documented with tenant isolation options + inherits cloudtrail, cloudwatch and the aws iam apparatus + pre-november-2024 pools keep the 50,000 mau free allowance cons
− free tier cut from 50,000 to 10,000 mau for new pools − the default tier for new pools is essentials at nearly 3x lite − scim is not mentioned on the features page + 3 more tested, not detailed here
we ranked 14 auth providers in total. the 3 that didn't make this page are written up in the full ranking →
how these were compared every tool on this page went through the same test as Keycloak — same tasks, same order, scored the same way. the comparison tables are the figures from that testing, not vendor spec sheets.
the auth providers test in full → was this useful?
yes · 0 no · 0
Clerk alternatives WorkOS alternatives Supabase Auth alternatives Better Auth alternatives Logto alternatives Descope alternatives