Auth0 vs Keycloak
This is the classic buy-vs-build decision for identity. Auth0 is a managed SaaS you pay per active user; Keycloak is open-source IAM you host yourself with no per-user fee. The trade is money and simplicity against control and operational responsibility.
The short version
If your reason for leaving Auth0 is per-MAU cost or vendor lock-in, and you have the platform skills to run a stateful service, Keycloak eliminates the meter entirely — SAML, OIDC and LDAP/AD federation are all built in, at any scale, for the cost of the infrastructure. If you'd rather not operate, patch and secure an identity server, and you value a hosted SLA and support, Auth0 keeps that burden off your team.
How they compare
| Auth0 | Keycloak | |
|---|---|---|
| Model | Managed SaaS | Self-hosted open source |
| License | Proprietary (Okta) | Apache-2.0 |
| Cost | Per-MAU + add-ons | Infrastructure only (no per-user) |
| Enterprise SSO (SAML) | Enterprise quote only | Built-in, no upcharge |
| LDAP / AD federation | Available | Built-in |
| Hosting & upgrades | Fully managed | You run it (or a managed host) |
| Data residency | Vendor-controlled | Fully in your control |
| Setup effort | Low (turnkey) | Higher (deploy, scale, secure) |
When Keycloak wins
- Per-MAU pricing has become the problem — Keycloak has zero per-user cost at any scale.
- You need SAML, OIDC and LDAP/AD without gating them behind an Enterprise quote.
- You need data in-house for compliance or residency, or want to avoid lock-in with open standards.
- You already run Kubernetes/containers and have the ops muscle to operate a stateful service.
When to stay on Auth0
- You don't want to own uptime, patching and scaling of an identity server — a breach or outage here is existential.
- You value a turnkey experience, hosted SLA and vendor support over maximum control.
- Your MAU count is modest or inside the free tier, so the managed convenience is effectively cheap.
Middle ground: managed Keycloak
You don't have to choose between "run it all yourself" and "pay per MAU." Managed Keycloak hosts — Cloud-IAM, Phase Two, Skycloak and others — run and upgrade Keycloak for you on flat infrastructure-style pricing, keeping the open-source core and zero-per-user model while offloading most of the ops. It's often the pragmatic exit from Auth0's per-MAU bill.