Simple, predictable pricing.
No MAU fees. No growth penalties. Pay for infrastructure, not users. Plans start at $29/mo, every plan includes unlimited users and full Keycloak admin access, and you can try any plan free for 21 days with no credit card.
Bigger deployments, custom compliance and migrations are quoted directly. Talk to our team.
Perfect for individual developers
Billed monthly
1 Cluster- Unlimited users
- Full Keycloak admin access
- All Keycloak features (SSO, MFA, SAML...)
- Full API access & Terraform provider
- 1 Custom domain
- Custom branding (powered by)
- Email support
For growing startups
Billed monthly
1 Cluster- Everything in Developer, plus:
- Medium cluster available
- Remove Skycloak branding
- User events & analytics
- Invite team members
- 4-hour support response
For established businesses
Billed monthly
2 Clusters- Everything in Launch, plus:
- 99.9% uptime SLA on the included Medium cluster
- Custom themes (upload & download)
- 30-day log retention
- 90-day insights dashboard
- 1-hour support response
- Security add-ons available
Custom needs & compliance
Tailored to your needs
3+ Clusters- Everything in Business, plus:
- Large clusters & 5 custom domains
- Up to 99.99% SLA guarantee
- 24/7 support & dedicated CSM
- All security add-ons included
- Private VPN connectivity included
How much does Keycloak cost?
Keycloak itself is free and open source under the Apache License 2.0, and there is no per-user or per-feature fee, however many users you have. What you pay for is running it: the servers, the time spent on upgrades and security patches, and someone on call when sign-ins fail. If you would rather not run it yourself, Skycloak managed Keycloak plans start at $29/mo.
What self-hosting Keycloak costs instead
- Servers: a three-node, high-availability cluster with PostgreSQL and a reverse proxy comes to about $710 a month in virtual machines, plus about $160 for network security, according to our self-hosting cost breakdown.
- Upgrades and patching: expect 8 to 24 engineering hours for each quarterly Keycloak upgrade, plus 2 to 8 hours a month of security patching, according to our self-hosted vs managed cost comparison.
- On-call hours: the same comparison puts on-call incident response at another 4 to 12 hours a month, and someone has to be reachable when sign-ins fail at night.
To weigh your options, see how managed Keycloak providers compare, read whether self-hosting Keycloak is worth it in 2026, size a cluster with our Keycloak production sizing guide, or put your own numbers into the IAM ROI calculator.
How does managed Keycloak pricing work?
Managed Keycloak pricing at Skycloak is based on infrastructure, not how many users you have. Plans start at $29/mo, and every plan includes unlimited users, full Keycloak admin access, and all core features (SSO, MFA, SAML, social login, and more). There is no per-MAU tax and no SSO tax, so your bill does not balloon as you grow. Try any plan free for 21 days, no credit card required.
Need custom compliance, dedicated support, or advanced security?
Enterprise adds large clusters, up to a 99.99% SLA, 24/7 support with a dedicated CSM, all security add-ons included, and private VPN connectivity. Tell us about your requirements and we will quote a plan that fits.
Enhance your deployment, only when you need it.
Infrastructure
Scale your identity infrastructure with additional resources
Additional Clusters
Scale horizontally by adding more Keycloak clusters. Run separate environments for dev, staging, and production, or distribute load across multiple instances. Choose from Small ($39/mo), Medium ($199/mo), or Large ($625/mo) clusters based on your needs.
Read the docs →Additional Custom Domains
Add more custom domains beyond what's included in your plan. Each tier includes 1 domain (Enterprise: 5). Additional domains are $49/mo each with automatic SSL certificates and CDN distribution.
Read the docs →Private VPN Connectivity
Keep authentication traffic off the public internet. Connect your Keycloak cluster to your cloud or on-premises network over an encrypted VPN, limited to the network ranges you choose. Essential for enterprises with strict network security requirements.
Read the docs →Security & Protection
Enterprise-grade security features to protect your authentication endpoints
Web Application Firewall
Protect your authentication endpoints from OWASP Top 10 vulnerabilities including SQL injection, XSS, and protocol attacks. Uses industry-standard OWASP Core Rule Set with configurable paranoia levels. Start in detection mode to tune rules before blocking.
Read the docs →IP Access Control
Restrict access to your authentication endpoints by IP address or CIDR range. Whitelist your office IPs for admin access, or blacklist known bad actors. Perfect for securing admin consoles while keeping user-facing endpoints open.
Read the docs →Rate Limiting
Stop brute force attacks and credential stuffing by limiting requests per IP or user. Configure thresholds for login attempts, token requests, and API calls. Attackers get blocked while legitimate users pass through seamlessly.
Read the docs →Geo-blocking
Control access based on geographic location. Block authentication from countries where you do not operate, or allowlist only approved regions. Meet data residency requirements and reduce exposure to region-specific threats.
Read the docs →CAPTCHA Protection
Add invisible bot protection with Cloudflare Turnstile. Unlike traditional CAPTCHAs, users rarely see a challenge while automated attacks are blocked. Privacy-focused alternative to reCAPTCHA with no tracking.
Read the docs →SIEM Integration
Stream authentication events to your security platform in real-time. Native integrations with Splunk, Datadog, Sumo Logic, Azure Sentinel, and Elastic. Correlate identity events with your broader security monitoring and meet compliance requirements.
Read the docs →Extensions & Customization
Extend Keycloak with custom functionality
Bring Your Own Extension
Deploy your own custom Keycloak SPIs, themes, or authenticators. Upload your JAR files through our dashboard and we handle the deployment, updates, and monitoring. Keep using your existing customizations without managing infrastructure.
Read the docs →Custom Extension Development
Need a custom authenticator, user federation, or protocol mapper? Our Keycloak experts build it for you. We handle development, testing, and deployment. Includes ongoing maintenance and updates for Keycloak compatibility.
Read the docs →Premium Support (Enterprise Only)
Upgrade your Enterprise urgent response time for mission-critical deployments
Priority Escalation
Brings Enterprise urgent response from the standard 1 hour to 30 minutes, with dedicated escalation paths and a named on-call contact for organizations where authentication downtime has significant business impact.
Read the docs →We support organizations making a difference.
Stop paying the MAU tax.
At 50,000 monthly active users, here is what you would pay each month:
Find the right plan for your needs.
| Feature | Developer$29/mo | Launch$149/mo★ Popular | Business$599/mo | EnterpriseCustom |
|---|---|---|---|---|
| Infrastructure | ||||
| Keycloak Clusters | 1 Small | 1 (Medium available) | 2 (Medium max) | 3 (Large included) |
| Custom Domains | 1 | 1 | 1 | 5 |
| Region Selection | ||||
| Private VPN | Add-on | Add-on | Included | |
| White Label Domain | Via Cloudflare Proxy | |||
| Auto-Upgrade & Maintenance Windows | ||||
| Developer Platform | ||||
| Public REST API | ||||
| API Keys | 10 | 25 | 50 | 100 |
| Terraform Provider | ||||
| MCP Server | ||||
| Authentication | ||||
| SSO (OIDC/OAuth) | ||||
| Multi-Factor Auth (MFA) | ||||
| WebAuthn/Passkeys | ||||
| Passwordless Auth | ||||
| Social Login Providers | Unlimited | Unlimited | Unlimited | Unlimited |
| SAML Support | ||||
| Custom Identity Providers | ||||
| User Management | ||||
| User Dashboard | ||||
| User Profiles & Attributes | ||||
| Role-Based Access Control | ||||
| Session Management | ||||
| User Event History | ||||
| Webhooks | 1 dest / 50 req/mo | 3 dest / 5K req/mo | 10 dest / 50K req/mo | Unlimited |
| Applications | ||||
| Application Management | ||||
| Setup Wizard | ||||
| Enterprise App Gallery | ||||
| Application Roles | ||||
| Branding & Customization | ||||
| Login Page Branding | ||||
| Custom Themes | ||||
| Theme Upload | ||||
| Theme Download | ||||
| Remove "Powered by" | ||||
| Email Templates | ||||
| Custom SMTP | ||||
| Analytics & Monitoring | ||||
| Auth Events | 7 days | 30 days | 90 days | |
| System Logs | 3 days | 30 days | 90 days | |
| Insights & Analytics | 30 days | 90 days | 365 days | |
| Live Tail | 5s delay | 5s delay | 5s delay | |
| Data Export | CSV | All formats | All + API | |
| Database Export | ||||
| Security | ||||
| WAF Protection | Add-on | Add-on | Included | |
| IP Access Control | Add-on | Add-on | Included | |
| Rate Limiting | Add-on | Add-on | Included | |
| Geo-blocking | Add-on | Add-on | Included | |
| CAPTCHA Protection | Add-on | Add-on | Included | |
| SIEM Export | Add-on | Add-on | Included | |
| Extensions & Migrations | ||||
| Extension Management | ||||
| Custom Extensions | Add-on | Included | ||
| Keycloak Migration | ||||
| Support & SLA | ||||
| Support Channel | Email & Chat | Extended Hours | 24/7 & Dedicated CSM | |
| Response Time (Urgent) | Best effort | 4 hours | 1 hour | 1 hour (24/7), 30 min with add-on |
| SLA Uptime | 99.9% | Up to 99.99% | ||
Calculate your monthly cost.
Estimate your monthly cost based on your plan, cluster size, and extra domains.
Included custom domains per plan: Developer 1, Launch 1, Business 1, Enterprise 5. Add more as needed.
Need security add-ons or multiple clusters?Use our full calculator →
Flat pricing was the deciding factor.
Knowing what we were going to pay up front and that there wasn't going to be any surprises, that was the deal maker.
Ryan MouserSenior Manager of Strategic Projects, ScratchThe flat pricing is easier to budget. I find it's fair when I looked at other competitors that price per user.
Dustin NewellPrincipal Web Developer, Beaulieu CanadaNot sure which plan is right for you?
Our team will help you find the perfect fit, and we can build a custom plan tailored to your specific requirements.