# keycloak

Source: https://startwithidentity.com/vendors/open-source/keycloak/
Last updated: 2026-06-19
License: content by Start with Identity. Cite the source URL.

---

## Overview

Keycloak is the most widely deployed open-source [identity and access management](https://startwithidentity.com/guides/fundamentals/what-is-iam/) server, now a CNCF project with Red Hat as primary sponsor. It provides SSO, OIDC and SAML federation, user federation, social login, and fine-grained authorization out of the box, all self-hosted and free of license fees. See the [open-source IAM category](https://startwithidentity.com/vendors/open-source/) and the [best IAM platforms](https://startwithidentity.com/rankings/best-iam-platforms/).

## What it is good at

Protocol coverage and flexibility are the strengths: OIDC, SAML, and OAuth2 are mature, MFA and increasingly passkey support are solid, and authorization services plus custom SPIs let you extend almost anything. Realms make multi-tenant setups practical. Because it is free under Apache 2.0 and battle-tested at scale, it delivers commercial-grade features at zero license cost, which is why it anchors so many self-hosted identity stacks.

## Where it falls short

The trade-offs are operational. You own scaling, high availability, upgrades, and database tuning, and major version jumps (such as the move to Quarkus) have required real migration effort. Lifecycle provisioning and governance reporting are weaker than commercial IGA tools, and the admin console, while capable, has rough edges. With competent platform engineers it is excellent value; without them it can become a maintenance burden.

## Pricing

Free and open source under Apache 2.0; self-host at no license cost. Commercial support is available through the Red Hat build of Keycloak and various third parties if you want SLAs. Model the operational cost, not just licensing, with the [TCO calculator](https://startwithidentity.com/tools/tco-calculator/).

## Best for, and who should look elsewhere

Choose Keycloak when you need a full-featured IdP you can self-host with no license cost and have the team to run it. For a modern, API-first alternative, compare [Keycloak vs Zitadel](https://startwithidentity.com/compare/keycloak-vs-zitadel/); for composable components and ReBAC, see [Ory](https://startwithidentity.com/vendors/open-source/ory/); for managed flat-priced self-hosting, see [FusionAuth](https://startwithidentity.com/vendors/ciam/fusionauth/).

## Bottom line

The default open-source IdP for teams that can run it, offering commercial-grade features at zero license cost. Budget for the operational work it requires.