Frequently Asked Questions

Find answers to common questions about Skycloak and managing your Keycloak instances.

General Questions

What is Skycloak?

Skycloak is a managed Keycloak service that handles the infrastructure and management of your Keycloak instances. We take care of hosting, updates, backups, and monitoring, allowing you to focus on implementing authentication and authorization in your applications.

Can I belong to multiple workspaces?

Yes. Signup creates one workspace for you, and you can join any number of additional workspaces by accepting invitations to them. Each membership has its own role, and you switch between workspaces with the workspace switcher.

How is Skycloak different from self-hosted Keycloak?

While Skycloak uses the same Keycloak software you can self-host, we provide:

Managed infrastructure and automatic updates
High availability and automatic scaling
Analytics and insights dashboard
Backup and disaster recovery
Professional support
Simple configuration interface

Which Keycloak versions does Skycloak support?

Skycloak supports Keycloak 20.0 and onwards, up to the latest release — new versions are added as soon as they’re released. If a version is missing, please contact us. You may notice that some patch or minor versions are missing; this is because we often keep only the latest version of a major version. Moreover, if we notice a version has major issues (performance or security), we will remove it from our supported versions.

Pricing and Billing

How does Skycloak pricing work?

Our pricing is based on:

Number of Keycloak clusters and their size (Small, Medium, Large)
Selected plan tier (Developer, Launch, Business, Enterprise)
Additional features and add-ons (e.g., extra custom domains, security features)

Unlike many identity providers, we do NOT charge based on user count - all plans include unlimited users.

What happens if I exceed my user limit?

WE DO NOT limit your user count. You can have as many users as you want.

Can I change plans at any time?

Yes, you can upgrade or downgrade your plan at any time. Changes are prorated to your billing cycle. Be aware that if you are using a medium or large cluster and you downgrade your plan, your cluster will be downgraded as well. Hence, be careful with your plan selection.

Yes. You must verify your email address before subscribing to a paid plan. If you haven’t received the verification email, check your spam folder or use “Resend Verification” in the app.

What happens to my trial realm when I upgrade?

You choose. After payment, a cluster setup wizard provisions your dedicated cluster and asks whether to Move your trial realm onto it or Delete it and start fresh. Moving is the default and carries over all users, credentials, and configuration; your issuer URL stays the same, so your applications keep working without changes. After a Move, the old shared realm remains available for 14 days before it is decommissioned.

Technical Questions

How do I connect my application to Skycloak?

Connect using standard Keycloak integration methods:

// Example configuration
{
  "realm": "your-realm",
  "auth-server-url": "https://your-instance-identifier.app.skycloak.io",
  "resource": "your-client",
  "public-client": true,
  "verify-token-audience": true
}

Can I use custom domains?

Yes, custom domains are available on all paid plans (Developer and above):

Open your cluster and click Custom domain in the sidebar
Add your custom domain
Update your DNS records as instructed
We handle SSL certificates automatically

How do you handle backups?

On the Business and Enterprise plans, Skycloak backs up your cluster’s database every day, and you can take an extra backup at any time with Backup now. Backups stay in the same region as your cluster.

Business keeps automatic backups for 14 days
Enterprise keeps automatic backups for 30 days
Launch uses Database Export for one-off copies

To restore, you download a backup and restore it into a new cluster; the original cluster is not changed. There is no point-in-time recovery: a restore brings back the cluster as it was when the backup was taken.

See the Backups guide for retention, restore steps and what a backup includes.

What is a realm?

A realm in Keycloak is a logical container for your users, applications, and security configurations. Think of it as a security boundary where:

Users are defined and managed
Applications (clients) are registered
Authentication policies are configured
User federation settings are managed
Groups and roles are defined

You can create multiple realms in your Keycloak cluster to separate different user bases or applications.

How do you handle multi-tenancy?

It depends on your onboarding path and plan:

Default trial (realm path): your realm is provisioned on Skycloak’s Shared Cluster, alongside other tenants’ realms. Isolation happens at the realm level, not the infrastructure level — your users, clients, and configuration are never visible to other tenants, but you’re not on a dedicated cluster.
Expert onboarding path and all paid plans: you get your own dedicated Keycloak cluster. This means:
- Full control over your entire Keycloak cluster
- No sharing of Keycloak resources with other customers
- Complete freedom to create and manage realms as needed
- Full isolation of your authentication infrastructure

Upgrading from the default trial provisions a dedicated cluster and lets you move your realm onto it, carrying over all users, credentials, and configuration.

For more details about our cluster offerings, check out Create Your Keycloak Instance.

Can I set up multiple environments (dev/staging/prod)?

Yes! For customers on Business and Enterprise plans, you can have multiple clusters for different environments:

You get a separate cluster for each environment (development, staging, production)
Each environment’s cluster can be sized according to your needs
Environments are completely isolated from each other since they are separate clusters
You have full control over each cluster’s configuration

What are the characteristics of a created cluster?

This applies to clusters you create yourself — the Expert onboarding path or any paid plan. (The default trial realm runs on the Shared Cluster instead; see How do you handle multi-tenancy? above.) Each created cluster has the following characteristics:

Complete isolation: Your cluster is not a tenant in a shared Keycloak instance - it’s a fully dedicated Keycloak cluster just for you
Admin console: The administration console is publicly accessible by default. To secure it, you have two options:
- Enterprise plan: Includes firewall rules, IP allowlisting, and VPN connectivity options
- Security add-ons: Available on Launch+ plans to add specific security features

Check out our Add-ons page for more security options (requires Launch plan or higher).

Security

How do you secure Keycloak instances?

Please visit our security page for more information.

What compliance standards do you meet?

Our service is compliant with:

SOC 2 Type II
GDPR
ISO 27001

For more details, visit our Trust Center.

How do you handle data privacy?

We follow strict data privacy practices:

Data encryption at rest and in transit
Data residency options
Regular security audits
Privacy-by-design principles

How do you handle disaster recovery?

We offer comprehensive disaster recovery solutions:

Basic Disaster Recovery (Business and Enterprise plans):

Daily database backups on the Business and Enterprise plans, restorable into a new cluster (see How do you handle backups?)
Automated recovery procedures

Advanced Disaster Recovery (Available as add-on):

Warm standby in separate regions
Zero RPO (Recovery Point Objective)
10-30 minute RTO (Recovery Time Objective)
Automated failover capabilities

For enhanced disaster recovery options, check out our Add-ons page.

For detailed information about our security and disaster recovery measures, visit our security page.

Performance and Reliability

What uptime do you guarantee?

Our SLA guarantees:

Developer & Launch: Best effort (no contractual SLA)
Business: 99.9% monthly uptime on the included Medium cluster, with service credits if we miss it
Enterprise: Up to 99.99% uptime with financial backing

Enterprise customers can also upgrade their urgent response times:

Standard: 1-hour response (24/7)
Priority Escalation add-on: 30-minute response

Visit our SLA page for more information.

How do you handle scaling?

We apply automatic scaling to large clusters. Automatic scaling based on:

User load
Request volume
Resource utilization

Troubleshooting

Common Integration Issues

Token Validation Failures

Common causes:

Clock synchronization issues
Incorrect client configuration
Network connectivity problems

Connection Problems

Troubleshooting steps:

Check network connectivity
Verify DNS resolution
Confirm firewall rules
Review client configuration

Support

How do I get help?

If you have an account with us, you may open a ticket in the support portal for more information. Response and resolution times vary by plan. For more details, please visit our SLA page.

Where can I report issues?

Report issues through:

Dashboard support portal
Email support@skycloak.io
Emergency channels (Enterprise plan)

Do you provide implementation support?

Yes, we offer:

Implementation guidance
Best practices consulting
Architecture review
Custom development