Open source (CNCF Incubating). self-host.
Keycloak pricing 2026
Keycloak is the open-source reference IdP - the longest-running and most widely deployed of the FOSS options. The honest cost is operational: hosting, postgres, upgrades, and platform engineering time. CNCF Incubating since 2023.
Tier breakdown
| Tier | $/user/mo | Annual min | Notes |
|---|---|---|---|
| Open source | Free | . | Free, Apache 2.0 licensed, unlimited MAU and seats |
| Red Hat build of Keycloak | Quote | . | Quote only via Red Hat. Supported distribution with SLA |
Pricing model: Apache 2.0 open source. Self-host is free; supported Red Hat distribution is quote only.
What it is best for
Platform engineering teams with Kubernetes capacity that want a fully featured IdP with no per-seat licence fee.
Hidden costs
- Upgrades between major versions are non-trivial - plan for a quarterly engineering investment.
- Postgres tuning, HA replication, and backup are your responsibility.
- Commercial support via Red Hat is quote only and routinely lands above $30k/yr for any meaningful SLA.
Feature support
YSAML 2.0
YOIDC
YSCIM
YMFA
YPasskeys
YConditional access
YLifecycle mgmt
YAudit logs
Device trust
YAPI access
YB2B federation
Governance
Source
https://www.keycloak.org/Verified 2026-06-02. Status: live-verified.
Compare with other IdPs
Last verified June 2026.