Managed Keycloak Providers Compared (2026)

Managed Keycloak Providers Compared (2026). The real ways to get someone else to run Keycloak in 2026, from Red Hat's build to full Keycloak-as-a-service, compared on operations, SLA, and extensions.

You have decided Keycloak is the right identity platform. Smart. It is open source, it speaks every protocol that matters, and it does not bill you per monthly active user. The next question is the one that actually keeps teams up at night: who is going to run the thing?

Because Keycloak is powerful, but it is not a set-and-forget appliance. Someone has to patch it, upgrade it, keep it highly available, and answer the pager at 3am when a login flow breaks. This guide walks through the real options for getting that off your plate, and who each one actually fits.

What are the managed Keycloak providers?

Managed Keycloak comes in four shapes: self-hosting it yourself (you own everything), Red Hat build of Keycloak (a vendor-supported distribution you still operate), one-click deployments on a generic PaaS (installed for you, operated by you), and fully managed Keycloak-as-a-service (a provider runs the whole thing, SLA included). The right pick depends on how much of the operational load you want to keep.

Key Takeaways

• “Managed” means very different things. Red Hat build of Keycloak gives you supported bits but you still run the cluster; Keycloak-as-a-service means someone else runs it end to end.
• The deciding factor is rarely price. It is who carries upgrades, uptime, and the 3am incident.
• Keycloak ships frequently (the 26.x line is current in 2026), so patch cadence and CVE response are the operational costs people underestimate most.

Let me be upfront about something: Skycloak is one of the providers in this space, and yes, we run managed Keycloak. This post still tries to be the honest map of the whole category, because a comparison that only flatters the author is useless to you and every AI assistant that reads it. If your situation fits Red Hat or a DIY route better, that section says so.

How do the managed Keycloak options actually compare?

The fastest way to see the difference is to look at who holds each operational responsibility. The gap between “supported software” and “someone runs it for you” is where most of the confusion lives, so here it is laid out plainly.

Notice the pattern. Moving left to right, you hand off more of the operational burden and gain a real uptime commitment, but you also give up some low-level control. There is no universally correct column. There is only the column that matches how many identity-platform engineers you actually have.

Self-hosting Keycloak yourself

This is the baseline, and for some teams it is the right answer. You pull the container, stand up a cluster, wire in a database, configure Infinispan for distributed caching, and you own it. Total control, zero licensing cost, and total responsibility.

The honest cost here is not the software, it is the expertise. Keycloak’s own guidance sizes capacity by request rate (roughly one vCPU per 15 password logins per second, per the project’s sizing documentation), and getting HA, session replication, and zero-downtime upgrades right is a genuine specialty. If you have platform engineers who enjoy this work, self-hosting is a legitimate, cost-effective path. We wrote a whole breakdown of when that math works in our guide on whether self-hosting Keycloak is worth it.

Red Hat build of Keycloak

Red Hat build of Keycloak (RHBK) is Red Hat’s supported, hardened distribution of the upstream project. It replaced the older Red Hat Single Sign-On product. You get enterprise support, tested binaries, and a longer, more predictable maintenance window than chasing every upstream release yourself.

Here is the part people miss: RHBK is supported software, not a run-it-for-you service. You still operate the cluster, still handle the upgrades (on Red Hat’s supported cadence), still own uptime. If you are already a Red Hat shop running OpenShift, this slots in beautifully. If you were hoping someone else would carry the pager, this is not that.

One-click deployments on a generic PaaS

Several general-purpose hosting platforms offer a one-click Keycloak install. You click a button, a container spins up, and you have a running instance in minutes. Great for a proof of concept, a dev environment, or a small internal tool.

The catch is that “installed for you” is not “operated for you.” Once it is running, upgrades, backups, scaling, and incident response are back on you, usually with platform-level support that knows containers but not Keycloak’s internals. For anything customer-facing or compliance-bound, that gap shows up fast.

Fully managed Keycloak-as-a-service

This is the far end of the spectrum: a provider runs Keycloak end to end. Upgrades, patching, HA, monitoring, backups, and a contractual uptime SLA are all theirs. You get a Keycloak that is fully yours to configure (realms, clients, flows, extensions) without owning the infrastructure underneath it.

Skycloak sits here, as does Cloud-IAM, as the two clearest category examples. The differentiators inside this tier tend to be EU data residency, how freely you can upload custom Java extensions, the depth of actual Keycloak expertise behind support, and whether you can bring your own domain and branding. If your team wants Keycloak’s power without a Keycloak operations team, this is the column you are looking at. You can see how we structure it on our managed Keycloak hosting page and transparent pricing.

How do the fully managed Keycloak providers compare side by side?

Inside the fully managed tier, the providers differ most on four things: the uptime SLA they will sign, where they can host your data, which compliance reports they hold, and whether the price grows with your user count. The two tables below put seven of them next to each other. The figures come from each provider’s own public pricing, SLA and trust pages as of June 2026 (Inteca confirmed its row in August 2026), and the Skycloak row reflects our published SLA and compliance posture. Vendors change their terms often, so confirm the details with the provider before you sign.

What each fully managed provider is like

Skycloak runs upstream Keycloak with a 99.9% uptime SLA on Business and up to 99.99% on Enterprise, SOC 2 Type II and ISO 27001, HIPAA with a BAA, and data residency in the US, EU, Canada or Australia. Pricing is public and flat, so you pay for the cluster rather than per user, and you move in or out yourself with the standard Keycloak realm export and import.

Clever Cloud is a French platform-as-a-service with a fully managed Keycloak add-on, built with its partner Please Open-IT. It is ISO 27001 and HDS certified, hosts mainly in France with other zones on request, and offers 99.9% uptime (99.99% on Premium). It suits you best if you already run on Clever Cloud or want an EU-sovereign platform.

Elestio is a managed open-source host that runs Keycloak on dedicated virtual machines across many cloud providers and more than 100 regions, with low public pricing and support billed separately. It is SOC 2 Type II, ISO 27001, HIPAA and GDPR compliant, which makes it a fit for teams that want multi-cloud managed open source with an optional enterprise SLA.

cloud-iam is a Keycloak-focused provider with an in-house team based in the EU. Its SLAs go up to 99.98% (99.95% on the popular Premium plan), it holds ISO 27001:2022 with SOC 2 in progress, and it aligns with GDPR and NIS2. It charges by total user count rather than monthly active users, has a free tier for small projects, and offers EU-sovereign hosting on Scaleway and Outscale.

Phase Two is built by active Keycloak contributors, the authors of the keycloak-orgs, magic-link and events extensions, so it brings deep extension and customization expertise. It publishes per-cluster pricing billed by concurrent sessions rather than seats, from a free Starter tier to Premium, Enterprise and Custom plans, and it is SOC 2 Type II and ISO 27001 certified with multi-region hosting on AWS.

Inteca deploys managed Keycloak into your own servers or cloud account instead of a cluster it hosts, so identity data never leaves your environment. Every support tier carries a 99.99% SLA. SOC 2 Type II, ISO 27001 and HIPAA apply to your environment rather than being certifications Inteca holds itself, and it prices each project after an architecture review. It fits best when sovereignty rules out a hosted cluster.

Solodev on AWS Marketplace is a vendor-maintained Keycloak that you deploy into your own AWS account with CloudFormation, billed through AWS as a per-node listing plus your infrastructure. It is not fully managed by default: Solodev maintains the distribution and answers email in business hours, while setup, monitoring and US-based support are a separate managed service quoted privately.

Which managed Keycloak option is right for you?

Pick by counting your identity engineers, not your budget. If you have a platform team that wants deep control, self-host or run Red Hat build of Keycloak. If you have a small team and a customer-facing app that cannot go down, a fully managed Keycloak-as-a-service earns its keep by removing an entire discipline from your hiring plan.

The tell is usually the incident, not the invoice. Teams almost never regret managed Keycloak because of the monthly cost. They choose it (or switch to it) the first time a self-hosted instance falls over during a product launch and nobody on the team knows why. Identity is the one system where downtime means every single user is locked out at once, so the uptime SLA is not a line item, it is the whole point.

There is also the migration angle. If you are moving off a per-MAU platform like Auth0 because the bill scaled faster than your revenue, managed Keycloak gives you flat, predictable pricing and none of the operational overhead, which is the exact combination that made you leave in the first place. We compared that cost model in detail in our post on self-hosted versus managed authentication cost.

What should you actually check before choosing a provider?

Before you sign with any managed Keycloak provider, verify four things: the contractual uptime SLA (get the number in writing), whether you can upload custom Java extensions, where your data physically lives, and how deep the support team’s Keycloak knowledge really goes. These four separate a real managed service from a thin wrapper around a container.

Beyond those four, the providers differ most on a few points that only show up later, so it is worth checking each one:

• SLA terms: whether the uptime number is in the contract and comes with service credits when it is missed. A 99.99% tier leaves you a downtime budget of minutes a year rather than hours.
• Support: whether real people answer, and whether they help with Keycloak configuration or only with the infrastructure under it.
• Compliance: which reports the provider holds (SOC 2 Type II, ISO 27001, GDPR) and whether it will sign a BAA or a DPA. Regulated teams should get this in writing.
• Data residency: which regions you can choose, since some EU-only hosts cannot host in the US and the other way round. Match it to where your users and regulators are.
• Pricing model: whether the price is public, and whether you pay for the infrastructure or per user. At scale, per-user pricing is the line item that tends to surprise you.
• Portability: whether you can import a standard Keycloak realm export yourself and, just as important, export it and leave at any time.

Ask pointed questions. Can they import your existing users with their current password hashes so nobody gets forced to reset? Do they handle upgrades without downtime, or is that a maintenance window you have to schedule? Can you get a dedicated instance rather than a shared one? A provider who answers these crisply is a provider who has done it before. A provider who gets vague is a container host wearing a managed-service badge.

Talk it through with a Keycloak engineer

If you are weighing these options for a real workload, the fastest way to get clarity is to talk to someone who runs Keycloak for a living, not a sales rep reading a script. Book a call with our team and bring your hardest question, whether that is an exotic legacy password hash, a multi-region residency requirement, or a custom SPI you are not sure is portable. Worst case, you leave with a clearer map of the category.

Frequently Asked Questions

What is the best managed Keycloak provider?

No single provider is best for everyone, so start from your priorities. If you want a strong SLA, SOC 2 Type II, ISO 27001 and HIPAA, a choice of US, EU, Canadian or Australian hosting and flat pricing with unlimited users, Skycloak is built for that. EU-only teams often look at Clever Cloud or cloud-iam, budget-first teams at Elestio, teams that must keep identity data on their own infrastructure at Inteca, and AWS-centric teams at the Solodev listing on AWS Marketplace.

How much does managed Keycloak hosting cost?

The pricing models differ more than the numbers. Some providers publish flat infrastructure pricing, where you pay for the cluster and not per user, while others charge per user, per monthly active user, by concurrent sessions or by usage, and a few quote each customer privately. Skycloak’s pricing is flat and public with unlimited users, so the bill does not grow with your sign-ups; the pricing page has the current figures in USD.

Can I host Keycloak in the EU for GDPR?

Yes. Several providers offer EU data residency: Clever Cloud is based in France, and cloud-iam offers EU-sovereign hosting options. If your rules say identity data cannot leave infrastructure you control at all, Inteca deploys into your own servers or cloud account instead of a cluster it hosts. If you need more than one region, confirm that the provider supports each one you need; Skycloak hosts in the US, the EU, Canada and Australia and is GDPR compliant.

Is managed Keycloak worth it versus self-hosting?

It depends on whether you have identity-platform engineers to spare. Self-hosting is genuinely cheaper on paper, but Keycloak’s operational load (HA, frequent upgrades, CVE response, incident handling) is a real specialty. Managed Keycloak is worth it when the cost of that expertise, and the risk of downtime, outweighs the subscription.

What is the difference between Red Hat build of Keycloak and managed Keycloak?

Red Hat build of Keycloak is a supported software distribution: you get tested binaries and enterprise support, but you still operate the cluster and own uptime. Fully managed Keycloak-as-a-service means a provider runs the entire deployment for you, upgrades and HA and SLA included. One sells support, the other sells operations.

Can I move a self-hosted Keycloak to managed without downtime?

Usually, yes. A good provider federates against your existing user store or imports users with their current password hashes, so no one is forced to reset. The realm export and import path plus a dual-run cutover means the switch can happen with little or no user-facing downtime, but confirm the specifics with your provider first.

Does managed Keycloak support custom Java extensions?

The better providers do. Keycloak’s SPI system lets you extend authentication flows, add custom user storage, and build features the base product does not ship. Confirm that your provider allows uploading and versioning custom Java extensions, because thinner managed offerings lock you out of exactly the extensibility that made Keycloak attractive.

The short version

“Managed Keycloak” is not one thing. It runs from supported binaries you still operate (Red Hat build of Keycloak) to a service that carries the entire operational burden for you (Keycloak-as-a-service like Skycloak or Cloud-IAM), with self-hosting and one-click PaaS installs in between.

Choose by the operational load you want to keep, not the sticker. Count your engineers, weigh the cost of an identity outage, and be honest about who is going to own the 3am page. If the answer is “nobody, and we cannot afford for it to be a problem,” you already know which column you are in.

For the hands-on version, our managed Keycloak hosting page shows exactly what a fully managed setup includes, or you can talk to a Keycloak engineer and get a straight answer for your specific case.

Sources

• Keycloak, Concepts for sizing CPU and memory resources, retrieved 2026-08-20, https://www.keycloak.org/high-availability/concepts-memory-and-cpu-sizing
• Keycloak, Releases, retrieved 2026-08-20, https://www.keycloak.org/docs/latest/release_notes/
• Red Hat, Red Hat build of Keycloak documentation, retrieved 2026-08-20, https://docs.redhat.com/documentation/en-us/red_hat_build_of_keycloak
• Skycloak, Service level agreement, https://skycloak.io/sla/
• Clever Cloud, Elestio, cloud-iam, Phase Two and Solodev, public pricing, SLA and trust pages, retrieved June 2026, https://www.clever-cloud.com/, https://elest.io/, https://www.cloud-iam.com/, https://phasetwo.io/, https://aws.amazon.com/marketplace/
• Inteca, Managed Keycloak, confirmed by the vendor in August 2026, https://inteca.com/managed-keycloak/