Simple, Predictable Pricing
No MAU fees. No growth penalties. Pay for infrastructure, not users.
Developer
Perfect for individual developers
Billed monthly
1 Cluster A cluster is a dedicated Keycloak instance in your chosen region. Each cluster supports unlimited users (millions+), has its own database, and provides isolated authentication services for your applications.
- Unlimited users
- Full Keycloak admin access
- All Keycloak features (SSO, MFA, SAML...)
- 1 Custom domain
- Custom branding (powered by)
- Email support
Launch
For growing startups
Billed monthly
1 Cluster A cluster is a dedicated Keycloak instance in your chosen region. Each cluster supports unlimited users (millions+), has its own database, and provides isolated authentication services for your applications.
- Everything in Developer, plus:
- Medium cluster available
- Remove Skycloak branding
- User events & analytics
- Invite team members
- 4-hour support response
Business
For established businesses
Billed monthly
2 Clusters A cluster is a dedicated Keycloak instance in your chosen region. Each cluster supports unlimited users (millions+), has its own database, and provides isolated authentication services for your applications.
- Everything in Launch, plus:
- Custom themes (upload & download)
- 30-day log retention
- 90-day insights dashboard
- 1-hour support response
- Security add-ons available
Enterprise
Custom needs & compliance
3+ Clusters A cluster is a dedicated Keycloak instance in your chosen region. Each cluster supports unlimited users (millions+), has its own database, and provides isolated authentication services for your applications.
- Everything in Business, plus:
- Large clusters & 5 custom domains
- Up to 99.99% SLA guarantee
- 24/7 support & dedicated CSM
- All security add-ons included
- Private Link/VPC included
Keycloak is trusted by teams at
Powering identity for enterprises and governments worldwide
Add-ons & Extensions
Enhance your Keycloak deployment with powerful add-ons
Infrastructure
Scale your identity infrastructure with additional resources
Additional Clusters
Scale horizontally by adding more Keycloak clusters. Run separate environments for dev, staging, and production, or distribute load across multiple instances. Choose from Small ($39/mo), Medium ($199/mo), or Large ($399/mo) clusters based on your needs.
Read the docsAdditional Custom Domains
Add more custom domains beyond what's included in your plan. Each tier includes 1 domain (Enterprise: 5). Additional domains are $49/mo each with automatic SSL certificates and CDN distribution.
Read the docsPrivate Link / VPC Peering
Keep authentication traffic off the public internet. Connect your Keycloak cluster directly to your AWS, Azure, or GCP VPC through private endpoints. Essential for enterprises with strict network security requirements.
Read the docsSecurity & Protection
Enterprise-grade security features to protect your authentication endpoints
Web Application Firewall
Protect your authentication endpoints from OWASP Top 10 vulnerabilities including SQL injection, XSS, and protocol attacks. Uses industry-standard OWASP Core Rule Set with configurable paranoia levels. Start in detection mode to tune rules before blocking.
Read the docsIP Access Control
Restrict access to your authentication endpoints by IP address or CIDR range. Whitelist your office IPs for admin access, or blacklist known bad actors. Perfect for securing admin consoles while keeping user-facing endpoints open.
Read the docsRate Limiting
Stop brute force attacks and credential stuffing by limiting requests per IP or user. Configure thresholds for login attempts, token requests, and API calls. Attackers get blocked while legitimate users pass through seamlessly.
Read the docsGeo-blocking
Control access based on geographic location. Block authentication from countries where you do not operate, or allowlist only approved regions. Meet data residency requirements and reduce exposure to region-specific threats.
Read the docsCAPTCHA Protection
Add invisible bot protection with Cloudflare Turnstile. Unlike traditional CAPTCHAs, users rarely see a challenge while automated attacks are blocked. Privacy-focused alternative to reCAPTCHA with no tracking.
Read the docsSIEM Integration
Stream authentication events to your security platform in real-time. Native integrations with Splunk, Datadog, Sumo Logic, Azure Sentinel, and Elastic. Correlate identity events with your broader security monitoring and meet compliance requirements.
Read the docsExtensions & Customization
Extend Keycloak with custom functionality
Bring Your Own Extension
Deploy your own custom Keycloak SPIs, themes, or authenticators. Upload your JAR files through our dashboard and we handle the deployment, updates, and monitoring. Keep using your existing customizations without managing infrastructure.
Read the docsCustom Extension Development
Need a custom authenticator, user federation, or protocol mapper? Our Keycloak experts build it for you. We handle development, testing, and deployment. Includes ongoing maintenance and updates for Keycloak compatibility.
Read the docsPremium Support (Enterprise Only)
Upgrade your Enterprise urgent response time for mission-critical deployments
Special Programs
We support organizations making a difference
Non-Profits
Registered 501(c)(3) organizations and charities making a difference.
Contact UsTrusted by teams using Keycloak worldwide
Keycloak is the #1 open-source identity solution, used by enterprises like Red Hat, Bosch, and government agencies worldwide.
Stop Paying the MAU Tax
At 50,000 monthly active users, here's what you'd pay:
Compare Plans
Find the right plan for your needs
| Feature | Developer $29/mo | Launch $149/mo | Business $599/mo | Enterprise Custom |
|---|---|---|---|---|
| Infrastructure | ||||
| Keycloak Clusters Dedicated Keycloak instances with different resource allocations (Small, Medium, Large) | 1 Small | 1 (Medium available) | 2 (Medium max) | 3 (Large included) |
| Custom Domains Use your own domain for authentication endpoints | 1 | 1 | 1 | 5 |
| Region Selection Choose where your Keycloak cluster is deployed for data residency and latency | ||||
| Private Link/VPC Connect your Keycloak cluster to your private network without exposing traffic to the internet | - | Add-on | Add-on | Included |
| White Label Domain Use your own domain for authentication pages without Skycloak branding in the URL | - | Via Cloudflare Proxy | ||
| Authentication | ||||
| SSO (OIDC/OAuth) Single Sign-On using OpenID Connect and OAuth 2.0 protocols | ||||
| Multi-Factor Auth (MFA) Add extra security with TOTP, SMS, email, or hardware key verification | ||||
| WebAuthn/Passkeys Passwordless authentication using biometrics, security keys, or passkeys | ||||
| Passwordless Auth Login without passwords using magic links, OTP, or biometrics | ||||
| Social Login Providers Allow users to sign in with Google, GitHub, Facebook, and other social accounts | Unlimited | Unlimited | Unlimited | Unlimited |
| SAML Support Enterprise SSO using SAML 2.0 protocol for legacy applications | ||||
| Custom Identity Providers Connect any OIDC or SAML-compliant identity provider | ||||
| User Management | ||||
| User Dashboard Centralized interface to manage all users and their attributes | ||||
| User Profiles & Attributes Store custom user data and attributes for personalization | ||||
| Role-Based Access Control Define roles and permissions to control access to resources | ||||
| Session Management View and manage active user sessions across devices | ||||
| User Event History Track user login history, password changes, and security events | - | |||
| Webhooks Receive real-time notifications for user events via HTTP callbacks | 1 dest / 50 req/mo | 3 dest / 5K req/mo | 10 dest / 50K req/mo | Unlimited |
| Applications | ||||
| Application Management Register and configure applications that use Keycloak for authentication | ||||
| Setup Wizard Guided setup for popular frameworks like Next.js, React, and Node.js | ||||
| Enterprise App Gallery Pre-configured templates for popular enterprise applications | ||||
| Application Roles Define application-specific roles for fine-grained access control | ||||
| Branding & Customization | ||||
| Login Page Branding Customize logo, colors, and messaging on login pages | ||||
| Custom Themes Create fully custom login page themes with CSS and templates | - | - | ||
| Theme Upload Upload custom theme files to Keycloak | - | - | ||
| Theme Download Download existing themes to customize locally | - | - | ||
| Remove "Powered by" Remove Skycloak branding from login pages | - | |||
| Email Templates Customize password reset, verification, and notification emails | ||||
| Custom SMTP Use your own email server for sending authentication emails | ||||
| Analytics & Monitoring | ||||
| Auth Events Detailed logs of authentication attempts, successes, and failures | - | 7 days | 30 days | 90 days |
| System Logs Keycloak system logs for debugging and troubleshooting | - | 3 days | 30 days | 90 days |
| Insights & Analytics Visual dashboards showing user trends, login patterns, and usage metrics | - | 30 days | 90 days | 365 days |
| Live Tail Real-time log streaming for monitoring active events | - | 5s delay | 5s delay | 5s delay |
| Data Export Export logs and analytics data for external analysis | - | CSV | All formats | All + API |
| Security | ||||
| WAF Protection Web Application Firewall to protect against common web attacks (OWASP Top 10) | - | Add-on | Add-on | Included |
| IP Access Control Whitelist or blacklist IP addresses to control access to your auth endpoints | - | Add-on | Add-on | Included |
| Rate Limiting Protect against brute force attacks by limiting authentication attempts | - | Add-on | Add-on | Included |
| Geo-blocking Block or allow access based on geographic location | - | Add-on | Add-on | Included |
| CAPTCHA Protection Add CAPTCHA challenges to prevent automated attacks | - | Add-on | Add-on | Included |
| SIEM Export Export security events to your SIEM (Splunk, Datadog, etc.) for centralized monitoring | - | Add-on | Add-on | Included |
| Extensions & Migrations | ||||
| Extension Management Install and manage Keycloak extensions and providers | ||||
| Custom Extensions Deploy your own custom Keycloak SPIs and extensions | - | - | - | Included |
| Keycloak Migration Migrate from self-hosted or other managed Keycloak to Skycloak | ||||
| Support & SLA | ||||
| Support Channel Available channels to reach our support team | Email & Chat | Extended Hours | 24/7 & Dedicated CSM | |
| Response Time (Urgent) First response time for urgent issues (service down, users cannot authenticate) | Best effort | 4 hours | 1 hour | 1 hour (24/7) |
| SLA Uptime Contractual uptime guarantee with financial backing | - | - | - | Up to 99.99% |
Calculate Your Cost
Estimate your monthly cost based on your needs
Each plan includes 1-3 domains. Add more as needed.
Need security add-ons or multiple clusters? Use our full calculator →
Not sure which plan is right for you?
Our team will help you find the perfect fit for your needs. We can also create a custom plan tailored to your specific requirements.
Frequently Asked Questions
After your trial ends, you'll lose access to your cluster if you haven't upgraded. No credit card required and no surprise charges. You can come back and sign up for a paid plan anytime.
Yes! You can upgrade or downgrade your plan at any time. Changes take effect immediately, and billing is prorated.
Enterprise is ideal for businesses with custom requirements, tighter compliance needs (HIPAA, SOC 2, ISO 27001), dedicated support, or specific infrastructure configurations. Contact our sales team to discuss your needs.
No credit card required. Start your 7-day free trial immediately. If you don't upgrade, your trial simply expires with no charges. Sign up for a paid plan whenever you're ready.
You get complete access to the Keycloak admin console, including custom themes, extensions, user federation, identity providers, and all standard Keycloak features.
Skycloak handles all infrastructure, updates, security patches, backups, and scaling. You get enterprise features like WAF, analytics, and 24/7 support without the operational burden.
Yes! Contact our sales team to learn about our startup and nonprofit programs with special pricing.
We accept all major credit cards (Visa, Mastercard, American Express) and can arrange invoicing for annual Enterprise plans.