This guide is written by the team that builds Casdoor and describes the standards as published (listed under Sources), with notes on how Casdoor implements them as of November 11, 2026. Spotted a mistake? Tell us.
Short answer: Keycloak itself is free, Apache-2.0 software. Managed Keycloak hosting is a commercial service that runs the cluster, database, upgrades, backups, monitoring and high availability for you. Published entry prices start around $29 per month for a small managed cluster, reach $599 per month for a production-grade tier with an SLA, and go to custom contracts above that. Self-hosting is cheaper in license cost and more expensive in engineering time.
The decision is not "Keycloak or managed Keycloak". It is "who operates Keycloak, and what happens when an upgrade breaks login at 2 a.m.".
What managed Keycloak hosting actually includes
A managed provider typically takes over:
- Infrastructure. Compute, network, TLS certificates and a managed database.
- Lifecycle. Upgrades and security patches, including the Keycloak major and minor releases.
- Availability. Multiple nodes, health checks, failover and, on higher tiers, a regional SLA.
- Data protection. Backups and, ideally, tested restore procedures.
- Observability. Metrics, logs, alerts and audit event retention.
- Support. A response-time commitment and someone to escalate to.
It does not take over identity design. You still own realms, clients, authentication flows, identity provider connections, role mappings and user lifecycle. That is why managed Keycloak is often cheaper than building login from scratch but more work than a turnkey identity service.
What it costs
The market has two pricing models.
Infrastructure-based. You pay for clusters and features, with unlimited users. Skycloak is the clearest example: $29 per month for a small cluster, $149 for Launch, $599 for Business with a 99.9% SLA, and custom Enterprise pricing. There is a 21-day trial and a 20% discount for annual billing. Extra clusters are $39/$199/$625 per month, and extra domains are $49 per month.
User-based or quoted. Cloud-IAM publishes a free Freemium tier up to 100 users, then quotes paid plans by user count and cloud provider, with SLAs from 99% to 99.98%. Phase Two prices by cluster with unlimited users, does not publish a rate card, and uses an illustrative comparison of about $21,000 per year for roughly 150,000 active users.
For reference, a small self-hosted deployment on two VMs with a managed database is often in the tens of dollars per month in infrastructure, before anyone touches it. The gap between that number and a managed plan is the price of operations.
Managed vs self-hosted: the real trade-off
Self-hosting Keycloak is the right answer when:
- you already run Kubernetes and have a platform team,
- identity is close to your core product and you want control over extensions,
- your scale makes a per-cluster or per-user fee significant,
- you have on-call coverage that can handle a login outage.
Managed Keycloak is the right answer when:
- nobody on the team wants to own Java, databases and upgrades,
- you need an SLA or a support contract,
- your scale is modest and the entry price is cheaper than the engineering time,
- you want to keep Keycloak compatibility without running the cluster.
A common middle ground is the Keycloak Operator on your own Kubernetes: lifecycle automation on infrastructure you control. It reduces the upgrade work but leaves the database, backups and monitoring with you.
If Keycloak compatibility is not a hard requirement, the third option is a different managed identity provider. Casdoor Cloud, for example, starts at $9 per month for a dedicated instance with OIDC, SAML, CAS, SCIM and LDAP, unlimited users, and no cluster to operate. That is usually cheaper than a managed Keycloak cluster at small and mid-size scale, but it is a product switch, not a hosting switch.
The checklist before you sign
Version and patch cadence. Keycloak releases frequently; 26.8.2 was the current release in November 2026. Ask how quickly the provider applies security patches and whether you can choose when to upgrade.
Extension support. If you depend on Keycloak SPI extensions or third-party extensions, confirm they are installed and supported. Some managed providers restrict arbitrary JARs.
Database and export access. Can you get a realm export, a user export and, if needed, database access? A managed service without an exit path is a lock-in.
Region and data residency. Where do the database and backups live? For EU or public-sector customers, this is often the deciding factor.
SLA scope. Check what the SLA covers: the whole cluster, only one included cluster, or only the production cluster. Read whether the SLA excludes upgrades and add-on clusters.
Limits and add-ons. Custom domains, API keys, webhook destinations, log retention and WAF are common add-ons. Model the bill at your actual usage.
Support terms. Response time is not resolution time. Ask what "urgent" covers and whether there is a named engineer.
Migration. If you are moving from self-hosted Keycloak, ask how realms, clients and users are imported. If you are moving away later, ask what export formats you get.
Cost model by scale
A rough way to think about it:
- Under 10,000 users, small team. A managed plan at $29 to $149 per month is usually cheaper than assigning an engineer to identity operations.
- 10,000 to 100,000 users, product company. Compare a managed cluster at $599 per month with a self-hosted Kubernetes deployment plus on-call. The managed plan often wins until you have a platform team.
- Above 100,000 users, identity-heavy. Self-hosting or a flat-price provider becomes attractive; per-user pricing at this scale is where bills grow fastest.
- Regulated or on-prem. Self-host or a provider that can deploy in your environment. Public managed cloud may be excluded by policy.
FAQ
Is Keycloak free to use in production? Yes. Keycloak is Apache-2.0 software; you can run it in production without a license fee. You pay for infrastructure and operations.
What does managed Keycloak cost? Published entry prices start around $29 per month for a small Skycloak cluster, with production tiers around $149 to $599 per month. Cloud-IAM and Phase Two quote paid plans; Phase Two uses an illustrative figure of about $21,000 per year for roughly 150,000 active users.
Do managed Keycloak providers charge per user? Some do, some do not. Skycloak and Phase Two advertise unlimited users with infrastructure-based pricing. Cloud-IAM quotes by user count and cloud provider.
Can I run Keycloak without Kubernetes? Yes. Keycloak runs on a VM or in containers. Kubernetes and the Operator make upgrades and scaling easier, but they are not required.
What is the alternative to managed Keycloak? Self-hosted Keycloak, or a different identity provider. Casdoor is an Apache-2.0 alternative with OIDC, SAML, CAS, SCIM and LDAP, available self-hosted or as a managed instance from $9 per month.
For a provider-by-provider comparison, see Skycloak alternatives. For deployment mechanics, see Keycloak with Docker Compose and Keycloak alternatives. Casdoor Cloud plans are on the pricing page.
Sources
Product names are trademarks of their respective owners.