Self-host Keycloak

updated Jul 2026deployed by usprices checked · Jul 2026Install verified on Ubuntu 26.04 · Jul 2026 · how we test

We earn commissions when you shop through the links below. Full disclosure →

A mature, enterprise-grade open-source identity and access management server — SSO, SAML, and OpenID Connect with user federation, built on Quarkus and backed by Red Hat.

Auth0 / yr$420

Self-hosted / yr~$283

You keep$137/yr

Pocket the difference — spin it up on a cheap VPS in minutes.Start free on Kamatera →

Key facts

CategorySSO & Identity

LicenseApache-2.0

StackJava, Quarkus

Min RAM1024 MB

Official imageyes

Difficulty

Sourcegithub.com/keycloak/keycloak

Websitekeycloak.org

Our recommendation

Reach for Keycloak when you want the most battle-tested, standards-complete identity provider available and can give it the memory a JVM wants — realms, federation, fine-grained authorization, and years of enterprise use behind it. If a lighter footprint or a more modern UX matters more than sheer maturity, authentik or Zitadel are the newer alternatives.

Follow the Keycloak deploy guide →

What you need

Any VPS with at least 1024 MB of RAM
A domain you control — most self-hosted setups need HTTPS in front of them
About the better part of a day

Where to host itaffiliate disclosure

Hetzner Cloudrun it on

From $23.59/mo · 2 vCPU / 4 GB / 80 GB · EU + US

Get Hetzner Cloud

Kamaterafree trial

From $4/mo · 1 vCPU / 1 GB / 20 GB · US + EU + Asia

Start free on Kamatera →

DigitalOceanalso works on

From $6/mo · 1 vCPU / 1 GB / 25 GB · US + EU + Asia

Deploy on DigitalOcean →

Paid link — we earn a commission if you shop through it.

Install

Run these commands on your server:

# Keycloak — official dev-mode Docker quickstart
docker run -p 127.0.0.1:8080:8080 \
  -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin \
  quay.io/keycloak/keycloak:latest start-dev
# start-dev is for evaluation only — see docs for a production start command

deploy guideHow to Deploy Keycloak on a VPS vps picksBest VPS for Keycloakbenchmarked quarterly · re-priced monthly

What you take on

Keycloak is the enterprise standard, and it asks for enterprise-grade attention in return:

non-negotiableIt's a JVM app. Budget 1–2 GB of RAM before it's comfortable — a 512 MB box will not do, and it's the heaviest option here.

non-negotiableThe concepts run deep. Realms, clients, scopes, and mappers are powerful but a real learning curve — plan time to model your setup correctly the first time.

non-negotiableUpgrades need reading. Major versions change defaults and occasionally storage — snapshot the database and read the migration notes before you jump versions.