Your applications already speak OIDC and SAML, so they carry over to managed Keycloak with new endpoints rather than new code, and the invoice stops tracking your user count.
The call is with an engineer rather than a salesperson. Bring your current setup and we will tell you what moving would involve.
Teams usually leave because of the pricing model, not the product.
Auth0 prices by monthly active users, so every successful quarter raises the cost of signing people in.
The first large customer who asks for SAML single sign-on can decide your plan for you.
When the price depends on usage and tier negotiations, finance cannot plan the line a year out.
Auth0 and Keycloak speak the same open standards, so most integration work is configuration.
Today this is a guided migration: our engineers plan it with your team and support each stage of the move. It is staged rather than a single big-bang cutover.
Applications, connections, rules and custom logic, user counts, and which users sign in with a password versus Google, Microsoft or a company identity provider.
A Skycloak cluster configured to mirror your current setup, so you can test every flow before any real user touches it.
Two routes, depending on what Auth0 support will give you. Where Auth0 support provides an export of password hashes for your database users, those hashes are imported and users keep their passwords. Where it does not, a just-in-time migration checks each password against Auth0 on the user's first sign-in to Keycloak and stores it there. A forced password reset is the fallback when neither suits. Users who sign in through a social or company identity provider need no password step at all.
Each application is repointed to its new OIDC or SAML endpoint one wave at a time, with a rollback for every wave. We work out with you how MFA enrollment moves. In many migrations users enroll again on first sign-in, and we plan when that prompt appears.
You pay for the infrastructure your identity runs on. Users are unlimited on every plan, so growth in sign-ups does not change the invoice.
| Plan | Price | Clusters included |
|---|---|---|
| Developer | $29 per month | 1 |
| Launch | $149 per month | 1 |
| Business | $599 per month | 2 |
| Enterprise | Custom | 3 or more |
Additional clusters cost more, so the bill grows with the number of environments and regions you run, not with the number of people who sign in. Annual billing takes 20% off. Full detail on pricing.
Skycloak runs upstream open source Keycloak, not a fork. On Launch, Business and Enterprise you can export any realm, including every user and their password hashes, as an encrypted standard Keycloak realm file that imports into any Keycloak server. The integration work you do once does not have to be repeated if you ever move again.
Once we got running with Skycloak and everything was basically set up, we just had to change a couple of URLs and it was pretty easy to integrate.
The call is with an engineer rather than a salesperson. Bring your current setup and we will tell you what moving would involve.