This article is written by the team that builds Casdoor, so we are not neutral, and we say where we think Casdoor fits and where it doesn't. Facts about other products come from their own websites as of November 11, 2026 (listed under Sources) and may have changed. Spotted something out of date? Tell us.
Short answer: Skycloak is a managed Keycloak hosting service. Its alternatives fall into three groups: run Keycloak yourself (free software, you own the operations), another managed Keycloak provider (Cloud-IAM, Phase Two), or a different identity provider that removes the Keycloak operational work entirely (Casdoor Cloud and others). Which one is cheaper depends on whether you are paying with money or with engineering time.
This article compares the published options and prices as of November 2026.
What Skycloak costs
Skycloak charges by infrastructure, not by user. Every plan includes unlimited users and full Keycloak admin access.
| Plan | Price | Included |
|---|---|---|
| Developer | $29/month | 1 small cluster, 1 custom domain, 10 API keys, 7-day auth events, best-effort support |
| Launch | $149/month | 1 cluster, medium available, 25 API keys, 30-day events, 4-hour urgent response |
| Business | $599/month | 2 clusters, medium maximum, 50 API keys, 90-day events, 1-hour urgent response, 99.9% SLA |
| Enterprise | Custom | 3+ clusters, large included, 5 domains, 100 API keys, 24/7 support, up to 99.99% SLA |
Annual billing saves 20%, and there is a 21-day free trial with no credit card. Extra clusters are $39 per month (small), $199 (medium) and $625 (large); extra custom domains are $49 per month. WAF, IP access control, rate limiting and SIEM export are add-ons on the lower tiers.
The important detail is that "unlimited users" is real: Skycloak does not meter MAU. You pay for clusters and features, not for the number of people who sign in. That makes it attractive for consumer or B2B workloads with many users and low revenue per user.
The alternatives
1. Self-hosted Keycloak
Keycloak is Apache-2.0 and free to run in production. You can deploy it on a VM, in Kubernetes, or with the Keycloak Operator. There is no license fee and no user cap.
What you pay instead:
- infrastructure (at least two nodes and a managed database for anything serious),
- upgrades, because Keycloak ships frequently and security fixes matter,
- backups, monitoring, TLS and incident response,
- the engineering time to do all of the above.
Self-hosting is the cheapest option at scale and the most expensive option in attention. It is the right choice when you already run Kubernetes and have someone who owns identity infrastructure. The deployment details are in Keycloak with Docker Compose.
2. Cloud-IAM
Cloud-IAM is a French managed Keycloak provider. It runs the infrastructure, database, high availability, upgrades, backups and monitoring, while you keep using the Keycloak admin console and extensions.
Its public plans are Freemium, Starter, Essential, Premium and Max. Freemium is free up to 100 users with no uptime guarantee; paid plan prices depend on user count and cloud provider, so they are quoted rather than listed. Published SLAs run from 99% on Starter to 99.98% on Max.
Cloud-IAM is a good fit when you want Keycloak compatibility and a European provider, and you are willing to go through a quote instead of a self-serve checkout.
3. Phase Two
Phase Two provides managed Keycloak clusters plus Keycloak extensions, and enterprise support for self-hosted Keycloak. Its model is a flat price per cluster with unlimited users and SSO connections, and it advertises a 30-day free trial.
Phase Two does not publish plan prices. Its own comparison page uses an illustrative figure of about $21,000 per year for roughly 150,000 active users, so treat that as a worked example rather than a rate card. It also offers a self-hostable core, which makes it less of a lock-in than a pure SaaS.
4. Casdoor Cloud
If the reason you are looking at managed Keycloak is "we need SSO, SCIM and a login page without running identity infrastructure", Keycloak compatibility may not be a requirement at all. Casdoor is an Apache-2.0 identity provider with OIDC, SAML, CAS, SCIM and LDAP, and its managed Cloud starts at $9 per month for a dedicated instance.
The pricing model is the opposite of Skycloak's infrastructure-based model: a flat monthly price per dedicated instance, with unlimited users and no per-MAU charge. Basic is $9 per month ($80 per year) for one organization and 10 applications; Premium is $25 ($200) with 10 organizations, a custom domain and customization; Enterprise is $59 ($450) with unlimited organizations, five domains, a staging instance and SIEM forwarding.
For a team that wants a managed identity service and does not need Keycloak's admin console or SPI extensions, Casdoor Cloud is usually cheaper than a managed Keycloak cluster at the small and mid-size end. For teams that need Keycloak specifically, it is not a drop-in replacement.
5. Keycloak Operator on your own Kubernetes
If you already run Kubernetes, the Keycloak Operator gives you a middle ground: managed-style lifecycle (deploy, upgrade, scale) on infrastructure you control. You still own the database, backups and monitoring, but the upgrade mechanics are automated. This is often the best cost-to-control ratio for a platform team.
Comparison
| Option | Model | Starting price | Users | Trial | You operate |
|---|---|---|---|---|---|
| Skycloak | Managed Keycloak | $29/month | Unlimited | 21 days | Nothing |
| Cloud-IAM | Managed Keycloak | Free to 100 users; paid quoted | Plan-dependent | Free tier | Nothing |
| Phase Two | Managed Keycloak | Quoted; flat per cluster | Unlimited | 30 days | Nothing |
| Self-hosted Keycloak | Software | $0 license | Unlimited | Not applicable | Everything |
| Keycloak Operator | Software on your K8s | $0 license | Unlimited | Not applicable | Cluster, DB, backups |
| Casdoor Cloud | Managed identity provider | $9/month | Unlimited | $4 credit | Nothing |
How to choose
Stay with a managed Keycloak provider if you need Keycloak's extensions, admin console or migration compatibility, and you do not want to run the cluster. Compare Skycloak, Cloud-IAM and Phase Two on region, SLA, extension support and the price at your cluster size, not only the entry price.
Self-host if you already have Kubernetes and an owner for identity infrastructure, and your user count is large enough that a per-cluster fee becomes significant.
Switch product if Keycloak compatibility is not a hard requirement. A managed Casdoor instance covers OIDC, SAML, SCIM and LDAP at a flat price, and removes both the cluster and the Keycloak admin complexity.
Watch-outs
- Managed Keycloak is still Keycloak. You still configure realms, clients, flows and identity providers. The provider removes the infrastructure, not the learning curve.
- Add-ons add up. WAF, extra domains and extra clusters can move the bill well above the entry price.
- Check the version cadence. Keycloak releases often; ask how quickly the provider applies security patches.
- Check the exit path. Can you export realms and users? A managed service that cannot give you a clean export is a lock-in.
- Do not compare only entry prices. A $29 plan with one small cluster and a $9 plan with a dedicated instance are different products; map the plan to your actual cluster, domain and support needs.
FAQ
Is Skycloak the same as Keycloak? No. Keycloak is the open-source identity server; Skycloak is a commercial service that hosts and operates Keycloak clusters for you.
Does Skycloak charge per user? No. Its plans include unlimited users and differ by clusters, domains, API keys, retention and support.
What is the cheapest managed Keycloak option? Cloud-IAM's Freemium tier is free up to 100 users. For paid production use, compare Skycloak's $29 Developer plan with Cloud-IAM and Phase Two quotes at your expected scale.
Can I migrate from Skycloak to self-hosted Keycloak? In principle yes, because both are Keycloak. In practice it depends on whether the provider gives you realm exports and database access. Ask before you commit.
For more on the operational trade-offs, see managed Keycloak hosting and Keycloak alternatives. Casdoor Cloud plans are on the pricing page.
Sources
Product names are trademarks of their respective owners.