CIAM on open source, fully managed.
CIAM, or customer identity and access management, is the system that signs your customers in to your product and keeps those accounts secure. It covers registration and login, social and enterprise single sign-on, multi-factor authentication, session control, consent, and the audit trail behind all of it. Skycloak delivers that as a managed service on real upstream Keycloak, so you get an open source CIAM without operating the servers.
21-day trial on the app path, no card required. · Unlimited users on every plan.
What is CIAM?
CIAM stands for customer identity and access management. It is the layer that lets the people who use your product create an account, prove who they are on every visit, and manage that account themselves, while giving you a record of what happened. Some vendors call the same thing consumer identity and access management; the two terms describe one category.
The word customer is doing the work in that definition. Customer identity management is not the same job as signing in your own staff, because the population is larger, it grows without anyone approving it, and the sign-up screen is part of your product rather than part of your IT department.
In practice a CIAM platform owns registration, login, social and enterprise single sign-on, multi-factor authentication, password reset, session and token handling, consent and privacy preferences, and the audit trail underneath all of it.
How CIAM works
Your application stops storing passwords and delegates identity to the platform. The exchange is standardised, which is why CIAM software from different vendors integrates in broadly the same way.
Redirect
A user clicks sign in and your app sends them to the identity provider, carrying a request that says which application is asking and what it needs to know.
Authenticate
The platform runs the flow: password, passkey, a social provider such as Google or GitHub, or a federated enterprise login through SAML or OIDC. MFA applies when your policy calls for it.
Return a token
The user comes back with a signed token stating who they are and what they may do. Your app verifies the signature rather than trusting the contents.
Maintain the session
Refresh, revocation, device and session listing, and sign-out across every application that shares the login.
Because the protocols are open, the same integration works against a hosted platform or one you run yourself, which is what makes moving between CIAM providers possible at all.
CIAM vs IAM
Both manage identities. They are built for different populations, and the requirements pull apart quickly.
| IAM (workforce) | CIAM (customers) | |
|---|---|---|
| Who it serves | Employees and contractors | The people who buy your product |
| Scale | Hundreds to tens of thousands | Thousands to tens of millions |
| Who creates accounts | IT, through an approval process | The user, unattended, at any hour |
| What sign-up has to do | Be secure and auditable | Be secure, auditable, and convert |
| Privacy obligations | Employment law, internal policy | Consent capture, data export, deletion on request |
| Typical pricing | Per seat, budgeted annually | Per monthly active user, grows with success |
| Downtime cost | Staff cannot work | Customers cannot buy |
Keycloak covers both, which is why teams that start with workforce SSO often keep the same platform when they add customer login. See single sign-on and workforce IAM.
What a CIAM platform has to cover
Most teams arrive at this checklist after building two or three of the items by hand.
Registration and login
Email, username, or passwordless. Verification, password reset, and account recovery that does not become a support queue. See passwordless.
Social and enterprise SSO
Google, GitHub, Microsoft and Apple for consumers; SAML and OIDC federation for the business customers who require it. See identity providers.
Multi-factor authentication
TOTP, WebAuthn and passkeys, applied conditionally so low-risk sessions are not punished. See MFA.
Authorization
Roles, groups and fine-grained permissions, so the identity layer answers what a user may do rather than only who they are. See RBAC.
Provisioning
SCIM, so enterprise customers can push and revoke their users from their own directory instead of emailing you a spreadsheet. Keycloak\'s own SCIM support is still experimental, so Skycloak ships it as a supported extension. See SCIM.
Audit and privacy
A searchable record of every authentication and admin event, which is what a compliance reviewer asks for first. See audit logs. Consent, export and deletion are built on top of it rather than shipped as a privacy console.
Open source CIAM
Most CIAM platforms are closed products that bill per monthly active user. Your user directory lives in their database, the price rises as you grow, and enterprise SSO is commonly held behind a sales conversation. Migrating away means rebuilding the identity layer.
Keycloak is the alternative most engineering teams land on. It is Apache 2.0 licensed, a CNCF incubating project, and covers the whole checklist above. There is no per-user fee and no vendor between you and your own user records.
The part Keycloak does not cover is operating it: upgrades, high availability, backups, certificate rotation and security patching stay with your team. That is the trade most teams are actually weighing, and it is the gap Skycloak fills: real upstream Keycloak, operated for you, with no fork and no lock-in.
You do not need to learn Keycloak first
Open source identity has a reputation for demanding a specialist, and that reputation is the main reason teams pick a closed CIAM they will later outgrow. Skycloak's onboarding is built for the opposite case: a team that wants customer login working today and has no interest in becoming a Keycloak administrator.
Signing up opens a choice of two paths. The first is "Sign-in for my app's users", and it takes about three minutes:
Pick your framework
A searchable grid covering React, Next.js, Vue, Angular, Nuxt, SvelteKit, Node.js, Express, Django, FastAPI, Flask, Spring Boot, .NET Core, Laravel, Rails, WordPress and Drupal. Anything not listed takes the Other card and gets generic OIDC credentials.
Copy the snippet
Skycloak creates the OIDC client for you and hands back paste-ready code for that framework.
Deploy
Your users can sign in as soon as it ships. At no point do you open the Keycloak admin console.
About 3 minutesYou get a fully managed realm on shared infrastructure, a hosted login page you can put your own logo on during onboarding, and a 21-day trial with no credit card. At no point do you open the Keycloak admin console.
The second path, labelled "I know Keycloak, give me an instance", gives you a dedicated cluster with admin console SSO, kcadm and Terraform snippets, and per-cluster feature flags. Teams who already run Keycloak usually start there. Either way you land on the same dashboard, and the skip link at the bottom of the welcome screen is always available.
If you are moving from another provider, you drive the import yourself and our team verifies the first realm with you before it carries live traffic.
Should you build CIAM or buy it?
Almost every team can build registration and login. The reason most stop building is that the first version is roughly a tenth of the work.
What arrives after launch is the rest of the list: password reset that resists enumeration, rate limiting and bot defence on the sign-up form, MFA enrolment and recovery, session revocation, a social provider whose API changes, then the first enterprise customer who requires SAML federation and SCIM provisioning before they will sign. Each item is a sprint, and each one is security-critical code your team now maintains forever.
The argument for buying CIAM solutions is not that authentication is hard to write. It is that authentication is expensive to keep correct while you are also building the product people actually pay for. The argument against buying is lock-in and per-user pricing, which is precisely what open source addresses.
What a CIAM platform is worth
Where the return actually shows up, in the order teams usually notice it.
Sign-up completion
Social login, passkeys and a reset flow that works remove the friction that loses accounts at the first screen.
Enterprise deals unblocked
SAML federation and SCIM turn a procurement objection into a configuration step, usually on the deal that pays for the platform.
Breach exposure
Credential stuffing, session fixation and token replay are handled by software that is maintained against them rather than by code you wrote once.
Compliance evidence
SOC 2 and ISO 27001 reviewers ask for authentication logs and access records early. Having them already indexed shortens the audit.
Engineering time
The team stops maintaining a login system and returns to the product, which is the cost that never appears on the invoice.
Privacy obligations
Consent, export and deletion requests arrive whether or not you built for them. GDPR, Quebec Law 25 and similar regimes assume the identity layer can answer.
CIAM vendors compared
The platforms teams shortlist most often, and the pricing model each one bills on, which is usually what decides the outcome at scale.
| Platform | Model | Billed on | Self-host option |
|---|---|---|---|
| Auth0 | Closed SaaS | Monthly active users | No |
| Okta Customer Identity | Closed SaaS | Monthly active users | No |
| Amazon Cognito | Closed, AWS only | Monthly active users | No |
| Stytch | Closed SaaS | Monthly active users | No |
| Clerk | Closed SaaS | Monthly active users | No |
| FusionAuth | Source-available | Per instance or hosted plan | Yes |
| Zitadel | Open source (Apache 2.0) | Active users on cloud | Yes |
| Ory | Open source (Apache 2.0) | Daily active users on cloud | Yes |
| Keycloak, self-hosted | Open source (Apache 2.0) | Your own infrastructure and time | Yes |
| Skycloak | Open source (Apache 2.0) | Infrastructure, not users | Yes, export any time |
The column that matters over a three-year horizon is the third one. A platform billed on monthly active users charges you more precisely as your product succeeds, and enterprise SSO is commonly held behind an upgrade. Skycloak bills for the infrastructure your realm runs on, so growth in users does not change the invoice. For a term-by-term breakdown see Skycloak vs Auth0, vs Okta, vs FusionAuth and vs Stytch.
How to choose a CIAM platform
Five questions separate the shortlist faster than a feature matrix does.
- What happens to the bill at ten times the users? Model it before you sign. Per-MAU pricing is comfortable at 10,000 users and painful at 500,000.
- Is enterprise SSO included or gated? If SAML federation sits behind an enterprise tier, your first large customer decides your pricing plan for you.
- Can you get your users out? Ask for the export format. If the answer is a support ticket and a CSV, you are not portable.
- Where does the data live? European and Canadian buyers will ask, and a region you cannot pin is a stalled deal.
- Who answers at 2am? Self-hosting means you do. A managed service should tell you the response time in writing, not on a sales call.
CIAM questions
What is CIAM?
CIAM stands for customer identity and access management. It is the system that signs your customers in to your product, keeps their accounts secure, and records what happened. In practice that means registration and login, social and enterprise single sign-on, multi-factor authentication, password reset, session control, consent and privacy preferences, and an audit trail you can hand to a compliance reviewer.
What is the difference between CIAM and IAM?
IAM manages the people inside your company. CIAM manages the people who buy from you. The distinction matters because the requirements diverge sharply: employee directories are measured in thousands and change slowly, while customer bases can be millions and register at any hour without anyone approving them. CIAM also carries obligations IAM rarely does, including consent capture, self-service data deletion, and sign-up flows that have to convert.
Is there an open source CIAM?
Yes. Keycloak is the most widely adopted open source identity platform and a CNCF incubating project. It covers OIDC and SAML, social and enterprise identity providers, MFA and passkeys, fine-grained authorization, and audit events. It is Apache 2.0 licensed, so there is no per-user pricing and no vendor holding your user directory. Somebody still has to run it, which is the trade this page is about.
Do I need to know Keycloak to use Skycloak?
No. Onboarding opens with a choice of two paths. The app path takes about three minutes: you pick your framework from a grid covering React, Next.js, Vue, Angular, SvelteKit, Node.js, Django, Spring Boot, .NET Core, Laravel, Rails and more, and Skycloak hands back a pre-configured OIDC client and a paste-ready snippet. Anything not listed gets generic OIDC credentials that work with any compatible stack. Your users can sign in as soon as you deploy. The second path, labelled "I know Keycloak, give me an instance", is there when you want the full admin console instead.
How much does CIAM cost?
Most CIAM vendors bill per monthly active user, so the invoice grows with your success and enterprise SSO is usually gated behind a sales call. Skycloak charges for infrastructure rather than users: every plan carries unlimited users and unlimited applications, and SSO is not a paid add-on. The app path starts with a 21-day free trial and no credit card. See pricing for the plans.
Can I move off it later?
Yes, and this is the practical argument for open source CIAM. Because Skycloak runs real upstream Keycloak rather than a fork, your realms, users, clients and configuration export in Keycloak's own format and import into any Keycloak instance, including one you run yourself, so none of the integration work has to be repeated.
Customer identity, without the operations
Unlimited users on every plan, US or EU data residency, and a real engineer on support. Export to your own Keycloak whenever you want.