Self-hosted Auth0 alternative: own your login layer with Keycloak

Every app you run needs a login. The moment you run more than one, you need them to share a login — one identity, one password, one place to switch someone off when they leave. That layer is quietly one of the most expensive things you can rent. Auth0 and Okta bill by the monthly active user, so your identity bill grows every time your product does, and the directory of everyone who can reach your systems lives on someone else's servers. Keycloak is that same capability, running on infrastructure you control.

What Keycloak is

Keycloak is a full identity and access management server — the open-source project Red Hat created and now develops in the open as a Cloud Native Computing Foundation project. It is not a stripped-down login widget. It speaks OpenID Connect, OAuth 2.0 and SAML 2.0, runs single sign-on across every app you point at it, federates against your existing LDAP or Active Directory, and enforces multi-factor authentication. It's the same class of software that sits behind large enterprise deployments.

Everything the admin console can do, a documented REST admin API can do too, so provisioning realms, clients and users can be scripted instead of clicked through by hand.

Contrast that with the Auth0 and Okta free tiers: a capped number of monthly active users, stronger MFA and SAML connections pushed up into paid plans, custom domains and branding gated, and audit logs you can only keep for so long. Keycloak hands you all of it at once, with no per-seat meter running in the background. The only real limit is the box it runs on.

The features that actually matter

• Single sign-on across every app — One login, one session. A user authenticates once and moves between all your applications without signing in again; log them out in one place and they're out everywhere.
• OpenID Connect, OAuth 2.0 and SAML 2.0 — The three protocols that matter for modern web and enterprise auth, all first-class. Almost anything you'd want to secure already knows how to talk to at least one of them.
• Identity brokering and social login — Let people sign in with Google, GitHub, Microsoft or any OIDC/SAML provider, or chain Keycloak behind another corporate IdP. On the hosted platforms, extra connections are usually a paid-tier line item.
• User federation — Point Keycloak at an existing LDAP directory or Active Directory and it authenticates against it live, with no user migration required. Kerberos single sign-on is supported too.
• Multi-factor authentication — Built-in TOTP one-time codes and WebAuthn/passkeys, set as required or optional per realm, with recovery codes. Stronger MFA is one of the first things the hosted tiers move behind a paywall.
• Realms — Fully isolated tenants inside one server: separate users, clients, roles and settings. Run staging and production, or several unrelated projects, from a single install.
• Roles, groups and fine-grained authorization — Role-based access control with composite roles and group inheritance, plus policy-based authorization services when you need permissions richer than "logged in or not".
• Themeable login, account and email — Every user-facing page and email is a template you can rebrand end to end. Custom branding is one more thing the SaaS tiers meter out.

Why self-host it instead of the hosted version

Your directory stays yours. The list of everyone who can log into your systems — their emails, their group memberships, their MFA enrollments — is among the most sensitive data you hold. Self-hosted, it lives in your database and never touches a third party's servers or their analytics. It also settles data-residency questions before they start: if you answer to GDPR or a contract that pins where personal data may live, keeping the identity store in your own database and region is the difference between a checkbox and a negotiation.

The cost doesn't scale per seat. Auth0 and Okta price on monthly active users, so success is punished: the more people log in, the larger the bill, forever. Keycloak's cost is the server it runs on. Ten users or ten thousand, the box is the box.

Control and branding are yours by default. Custom login domains, fully rebranded pages and emails, arbitrary authentication flows, password policies, token lifetimes — all standard, not upsells. And because Keycloak is extensible through its provider interfaces, you can bend its behavior to your product instead of the other way around.

Who it's for

Teams running more than one app who are tired of a separate user table in each one and want a single sign-on layer they own.

Companies with an existing directory — an LDAP server or Active Directory — that want modern OIDC and SAML on top of it without ripping anything out or paying per head to bridge the two.

SaaS builders and agencies who need real multi-tenancy, MFA and branded login for clients, and would rather not hand their customers' identities — and a growing per-user invoice — to Auth0.

The honest setup notes

Keycloak is enterprise software, and running it yourself means owning a few real chores. It needs a proper relational database — PostgreSQL is the usual choice — behind it; the embedded dev store is not for production, and since your entire user directory lives in that database, backups are not optional. It's a JVM application, so budget real memory: a gigabyte or more, and more under load. You'll want SMTP wired up for email verification and password resets. Keycloak is also strict about its public hostname and won't serve auth over plain HTTP outside dev mode, so the reverse proxy and TLS have to be right. And major version upgrades occasionally shift defaults and want care around realm migrations.

None of it is exotic, but it's a standing job. Or let us run it — database, TLS, SMTP hookup, memory and updates handled, so you get the identity server without the operations shift.

Deploy it in one click

Rolling your own means provisioning a host, installing a database, tuning the JVM, terminating TLS, configuring the hostname, connecting SMTP, and then keeping all of it patched. It's very doable, and it's an afternoon that becomes a recurring responsibility.

On Caliber Node it's one click. We stand up Keycloak on a managed database with TLS and email already wired, sized with the memory it actually needs, and we keep it patched. You get the admin console, real logs and SFTP access to your instance — you deploy Keycloak in one click and start creating realms, not reading install docs. It's the full, unmodified Keycloak, on infrastructure you control, without the setup becoming your second job.

First run

1. Sign in to the admin console with the bootstrap admin credentials, and immediately set a strong password.
2. Create a new realm for your apps — leave the master realm for administration only.
3. Add a client for your first application: choose OpenID Connect, set its redirect URIs, and note the client ID and secret.
4. Create a user (or connect an LDAP/Active Directory federation source), set a password, and optionally require MFA.
5. Point your app at the realm's discovery URL, trigger a login, and watch the SSO round-trip complete.

That's a working identity provider — one you can now put in front of every other app you run.

The bigger picture

Authentication is the front door to everything you build. Renting it means someone else holds the keys, meters who walks through, and raises the toll as you grow. Owning it means the door, the lock and the guest list are yours — auditable, brandable, and free of a per-user tax on your own success. Keycloak has spent over a decade proving that self-hosted identity can be enterprise-grade, and it costs nothing but the server.

Deploy Keycloak in a few minutes → https://calibernode.com/cloud-apps

Or browse the full app catalog.

One-click self-hosted apps, managed for you — real logs, SFTP, and your data always exportable. Never a black box.