Self-host Keycloak

updated Jul 2026deployed & timed by usprices checked · Aug 2026Install verified on Ubuntu 26.04 · Jul 2026 · how we test

A mature, enterprise-grade open-source identity and access management server — SSO, SAML, and OpenID Connect with user federation, built on Quarkus and backed by Red Hat.

Auth0 / yr$420

Self-hosted / yr~$55

You keep$365/yr

Pocket the difference — spin it up on a cheap VPS in minutes.Start free on Kamatera →

Key facts

CategorySSO & Identity

LicenseApache-2.0

StackJava, Quarkus

Min RAM1024 MB

Dockeryes

Difficulty

Our recommendation

Reach for Keycloak when you want the most battle-tested, standards-complete identity provider available and can give it the memory a JVM wants — realms, federation, fine-grained authorization, and years of enterprise use behind it. If a lighter footprint or a more modern UX matters more than sheer maturity, authentik or Zitadel are the newer alternatives.

What you need

Any VPS with at least 1024 MB of RAM
A domain you control — most self-hosted setups need HTTPS in front of them
About the better part of a day

Install

Run these commands on your server:

# Keycloak — official dev-mode Docker quickstart
docker run -p 127.0.0.1:8080:8080 \
  -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin \
  quay.io/keycloak/keycloak:latest start-dev
# start-dev is for evaluation only — see docs for a production start command

vps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly

What you take on

Keycloak is the enterprise standard, and it asks for enterprise-grade attention in return:

non-negotiableIt's a JVM app. Budget 1–2 GB of RAM before it's comfortable — a 512 MB box will not do, and it's the heaviest option here.

non-negotiableThe concepts run deep. Realms, clients, scopes, and mappers are powerful but a real learning curve — plan time to model your setup correctly the first time.

non-negotiableUpgrades need reading. Major versions change defaults and occasionally storage — snapshot the database and read the migration notes before you jump versions.

An alternative to

Auth0 →

Head-to-head

SSOAug 2026

Keycloak

authentik

Modern and self-hoster-friendly vs. the enterprise standard.

The JVM incumbent vs. a modern, lighter Go alternative.

Read the verdict →

More in SSO & Identity

SSO & Identity