Keycloak vs Kinde: Control, Enterprise SSO and Cost at Scale

Kinde is a hosted authentication service with per-user pricing, built-in subscription billing and feature flags, while Keycloak is open source, runs anywhere you can run a container, and covers SAML, LDAP and Active Directory federation and deep customization through its SPIs (Service Provider Interfaces, the Java plug-in points of the server). Pick Kinde when you want startup logins working quickly and like having billing in the same tool. Pick Keycloak, self-hosted or managed, when you need control over where it runs, enterprise SSO for customers who bring their own directory, and a cost that does not grow with every new user.

This guide is for developers and technical founders who already use Kinde or have it on a shortlist, and who know the basics of OpenID Connect (OIDC). We go through what each tool is built for, a feature table, how the two pricing models behave as you grow, where your data lives, how you extend each one, and finally how you would move users from Kinde to Keycloak if you decide to.

What Kinde and Keycloak are built for

Kinde describes itself as a developer platform with built-in authentication, access management and billing, so that a SaaS product can sign users in and charge them from the same dashboard. It is a hosted service: Kinde runs the servers, stores your users and gives you SDKs and a management API. Its pricing page and documentation describe that hosted service only, and neither offers a self-hosted edition.

Keycloak is an open-source identity and access management server, and its GitHub repository lists the Apache License 2.0. You run it yourself on Kubernetes, virtual machines or a laptop, or you let a provider run it for you. It speaks OIDC, OAuth 2.0 and SAML 2.0, federates LDAP and Active Directory, and lets you replace or add almost any part of the login process with your own code.

Both are OIDC providers, so an application that uses a standard OIDC library talks to either one in the same way. The OIDC Core specification defines the ID Token, and its authentication section describes three ways to authenticate: the Authorization Code Flow, the Implicit Flow and the Hybrid Flow. Keycloak’s guide to OIDC layers explains how to connect an application through any certified library rather than a vendor SDK. That shared standard matters later, when we talk about migration.

Keycloak vs Kinde feature comparison

The Kinde column comes from its pricing page and docs at the time of writing, and some features sit on specific plans, which the table notes.

If you want to read the same table for other hosted services, our comparisons of Keycloak vs Clerk, Keycloak vs Auth0, Keycloak vs Frontegg and Keycloak vs FusionAuth follow the same structure.

Where Kinde is the better choice

Kinde deserves credit for a few things Keycloak simply does not try to do, and you should weigh them honestly before switching.

Billing in the same place as login. Kinde can create subscription plans, meter usage and take payments through Stripe, and it ties those plans to the user and organization records it already holds (about Kinde billing). With Keycloak you would connect a billing system yourself and pass plan information into tokens with a mapper or an event listener. If you are a small team selling a self-serve product, that integration work is real, and Kinde removes it.

Feature flags without another vendor. Kinde lets you define flags, and its feature flag docs describe how to “edit the flag value in a specific environment or for a particular organization or user”. Keycloak has no feature flag system, so you would use a separate tool or model flags as roles and attributes, which works but is not what those were designed for.

Speed to the first login. Because Kinde is hosted and ships SDKs for common frameworks, you can have sign-up and sign-in working in an afternoon without deciding where a server runs, how it is backed up or how it is upgraded. A self-hosted Keycloak needs a database, a deployment, TLS and an upgrade plan before your first user signs in. A managed Keycloak service closes most of that gap, but you still configure a realm and a client yourself, which takes a little longer than dropping in a vendor component.

Where Keycloak is the better choice

Enterprise SSO and directory federation

Business customers usually arrive with an identity provider of their own, and the more of them you sign, the more connections you need. In Keycloak you add each customer’s SAML or OIDC provider to a realm through identity brokering (identity brokering), and it can act as a SAML service provider for partner systems, which our Keycloak SAML service provider guide walks through. Kinde supports enterprise connections too, with one included on its lower plans and unlimited connections from the Plus plan (pricing).

The bigger gap is directories. Keycloak reads users straight from LDAP or Active Directory and can keep them in sync, so employees of an on-premises customer sign in with the passwords they already have (LDAP federation). Kinde’s list of enterprise connections covers Entra ID, Google Workspace, Okta, Cloudflare, LastPass and custom SAML, but no LDAP. If your buyers run Active Directory without a cloud identity provider in front of it, read our explanation of Keycloak LDAP user federation before you decide.

For provisioning, the Keycloak 26.8 release notes have a section titled “SCIM API (supported)”, which says “It enables seamless integration with identity management systems and applications that support the SCIM protocol.” Kinde’s pricing page lists “SCIM (Coming soon)” among the Scale plan features.

Extensibility: Keycloak SPIs vs Kinde workflows

Kinde workflows are TypeScript or JavaScript files that Kinde runs when a trigger fires, for example when tokens are generated for a user, so you can add custom claims or call an outside API during sign-in (workflow files). That model is pleasant for small changes, and it keeps the code in your repository, but you can only act at the triggers Kinde provides.

Keycloak’s SPIs go deeper because they replace parts of the server itself. You can write a custom authenticator and place it anywhere in a login flow, plug in your own user store so Keycloak reads users from a legacy database, listen to every event synchronously, or add a protocol mapper that builds claims however you like. The trade-off is that SPIs are Java and you build them as JAR files, which our Keycloak custom SPI development guide explains step by step. If the change you need is “add one claim”, Kinde’s workflows are simpler. If it is “change how authentication works”, Keycloak lets you do it.

Self-hosting and data residency

Kinde lets you choose a data region in Sydney (Australia), Oregon (USA), Quebec (Canada), Dublin (Ireland) or London (UK), and its supported data regions page says “Once selected, you cannot change the data region of your business within Kinde.” That covers many residency requirements, but the data still lives in Kinde’s infrastructure, in the regions Kinde offers.

With Keycloak you choose the database, the cloud, the country and even the network it runs in, because you can run it anywhere. A regulator, an air-gapped customer or a data processing agreement that names a specific provider is something you can satisfy by deploying there. If you want this control without running the servers yourself, Skycloak Managed Keycloak lets you pick a region in the cluster settings when you create a cluster, with region selection listed on every paid plan. Database export of the whole cluster is included on the Launch, Business and Enterprise plans, not Developer (pricing), so you can take your data with you. Our post on whether self-hosting Keycloak is worth it in 2026 covers the operational side of that choice.

Keycloak vs Kinde cost at 10,000 to 1,000,000 users

We are not quoting Kinde’s prices here because they change, so check the Kinde pricing page for current numbers. What matters for planning is the shape of each model.

Kinde charges a monthly plan fee, includes a free allowance of monthly active users (MAU), and charges per MAU above it, with a slightly lower rate on higher plans. Users who pay you through Kinde billing do not count toward MAU, and Kinde takes a percentage of each customer transaction it processes (pricing). At ten thousand users that is very affordable. The per-MAU charge grows in a straight line with your audience, so moving from a hundred thousand to a million active users multiplies that part of the bill by ten, and enterprise needs such as SCIM push you onto a higher plan as well.

Keycloak’s cost does not depend on how many users you have stored. Keycloak’s own sizing guide, Concepts for sizing CPU and memory resources, sizes CPU by request rate: “For each 15 password-based user logins per second, allocate 1 vCPU to the cluster”, with 1 vCPU for each 120 client credential grants per second and each 120 refresh token requests per second. It adds “Leave 150% extra head-room for CPU usage to handle spikes in the load”, and says “The base memory usage for a Pod including caches of Realm data and 10,000 cached sessions is 1250 MB of RAM.” A million registered users who sign in a few times a week produce far fewer logins per second than that headline number suggests, so a modest cluster often carries them.

Self-hosted, you pay for those machines, a database and the engineering time to operate them. With Skycloak Managed Keycloak, you pay for a plan with no monthly active user limits, where the clusters included and the add-on clusters you buy set the price. To put your own numbers into both models, use our IAM ROI calculator.

How to migrate from Kinde to Keycloak

Moving off Kinde is more practical than moving off many hosted services, because Kinde exports password hashes. The Kinde data export contains organizations.ndjson, users.ndjson and access_requests.ndjson, and exported passwords appear “as a hashed password, a hashing algorithm (e.g. bcrypt), and other hashing configuration details (e.g. salt and salt location).” The same page says “only team members who are Owners can export data”, and that a file with passwords “is encrypted using AES-256-CTR” and “can only be decrypted if you have the unique Key and Initialization Vector (IV) provided during download”, so plan who will handle it.

You export users with their hashes from Kinde (1), prepare a Keycloak realm with a matching hash provider (2), import the users and re-create the connections (3), and point each app at the new issuer so people sign in with their old passwords (4).

1. Export users and organizations from Kinde. Run the data export with passwords included and keep the decrypted file somewhere only the migration job can read it.
2. Prepare the Keycloak realm. Create one OIDC client per application, the roles and groups your apps check, and organizations for your B2B customers. The HashAlgorithm section of the admin guide says “Supported password hashing algorithms are shown in the following table”, and that table lists argon2, pbkdf2-sha512, pbkdf2-sha256 and pbkdf2; bcrypt is not among them, so for bcrypt hashes you install a bcrypt provider such as the open-source keycloak-bcrypt extension. On Skycloak Managed Keycloak, the extensions docs say the marketplace is available on all plans, and custom extension uploads are included on Enterprise and available on Business with the Bring Your Own Extension add-on.
3. Import users with their hashes. The Admin REST API and realm import both take user credentials as a CredentialRepresentation, whose secret and credential data carry an existing hash, its algorithm and its parameters, so users keep their passwords. The HashAlgorithm section of the admin guide says “If you change the hashing algorithm, password hashes in storage will not change until the user logs in.” Users who signed in only with Google or another social provider have no password to move: configure the same provider in Keycloak and let its first broker login flow link them to the imported accounts by email.
4. Re-create enterprise connections. For each customer with SSO, add their SAML or OIDC identity provider to the realm, ideally inside that customer’s organization, and send them Keycloak’s new redirect URI or SAML metadata to register.
5. Switch the applications. If an app uses a standard OIDC library, you change the issuer URL, client ID and secret. If it uses a Kinde SDK, replace it with an OIDC library for your framework, and move anything you read from Kinde-specific claims, such as feature flags, into Keycloak protocol mappers or your own service.
6. Run both side by side, then cut over. Point a staging copy of each app at Keycloak, test sign-in for password, social and SSO users, and switch production once each path works.

If you would rather leave users where they are for a while and move them gradually, our comparison of federating versus migrating legacy users explains when each approach makes sense.

Kinde alternatives worth comparing

If you are looking at Kinde alternatives more broadly, the field splits into two groups. Hosted services such as Clerk, Auth0 and Frontegg give you the same “someone else runs it” experience as Kinde, each with its own mix of UI components, B2B features and per-user pricing. Open-source servers such as Keycloak and FusionAuth let you self-host, keep the database and avoid per-user fees, and Keycloak has the widest protocol and federation coverage of them. Our comparisons linked above go through each pairing in detail, so you can check the features your customers ask for against each option.

Frequently asked questions

Can I self-host Kinde?

No. Kinde is a hosted service, and its pricing page and docs describe no self-hosted edition. You choose a data region, and Kinde runs the infrastructure. Keycloak can be self-hosted anywhere, or run for you by a managed provider.

Does Kinde support LDAP or Active Directory?

Kinde’s enterprise connections include Microsoft Entra ID and several SAML providers, and no LDAP connection, so an on-premises Active Directory may need a cloud identity provider in front of it. Keycloak federates LDAP and Active Directory directly.

Is Keycloak cheaper than Kinde?

At a few thousand users Kinde can cost very little, because of its free MAU allowance. As you grow, Kinde’s per-MAU charge rises with your audience, while Keycloak’s cost follows login rate and infrastructure, which grows much more slowly. A Skycloak Managed Keycloak plan, with no monthly active user limits, keeps the bill predictable, and the ROI calculator lets you model your own numbers.

Can I move users and passwords from Kinde to Keycloak?

Yes. Kinde’s data export includes password hashes with their algorithm, and Keycloak accepts hashed credentials on import. For bcrypt hashes, install a bcrypt hash provider first, and users sign in with their existing passwords.

Does Keycloak have billing and feature flags like Kinde?

No. Keycloak handles identity and access, not payments or feature flags. Teams that move from Kinde usually connect a billing system such as Stripe directly and use a feature flag tool, passing the plan or entitlements into tokens with a Keycloak mapper.

Choosing between Kinde and Keycloak

If you are building a self-serve product, want billing and feature flags in one place and expect to stay at modest scale, Kinde is a reasonable choice and will get you live quickly. If your customers ask for SAML, Active Directory or SCIM, if you need to decide exactly where identity data lives, or if your user count is heading toward the hundreds of thousands, Keycloak gives you that control without a per-user bill. A good next step is to run both for a week against a staging copy of your app and see how each handles the sign-in paths your customers actually use.

Want Keycloak’s control without running the cluster yourself? Try Skycloak Managed Keycloak and run it beside your Kinde setup for a week, or model the cost difference with the ROI calculator.