Clerk is a hosted authentication and user management service for web apps, priced by monthly retained users and enterprise SSO connections. Pages here cover moving to self-hosted ZITADEL, Ory or Keycloak.
Moving a Clerk application to self-hosted ZITADEL: exporting users with hashed passwords from the dashboard, importing them so users keep their passwords, mapping Clerk organizations and enterprise connections, and replacing Clerk's prebuilt components with ZITADEL's hosted login.
Moving from Clerk to self-hosted Ory Kratos: importing the exported users and password hashes, building the login and account screens Clerk provided as components, social and passkey login, and what needs Ory's enterprise license, such as SAML and organization login.
Comparing Clerk with ZITADEL: prebuilt UI components against a hosted login you run, B2B organizations, passkeys and MFA, enterprise SSO without per-connection fees, ZITADEL's AGPL core and Cloud option, and the operating work of self-hosting on PostgreSQL.
Comparing Clerk with Keycloak for application login: developer experience and frontend components, SAML and OIDC brokering for customer SSO, organizations, theming, scale and cost at high user counts, and the Java operations Keycloak brings.
Clerk's drop-in components against Ory's headless APIs: how much UI you build, identity schema flexibility, OAuth2 and OIDC through Hydra, the features Ory reserves for its enterprise license, and which team shape each suits.
Cost of ownership by component: Clerk plan fees, monthly retained user overage tiers, per-connection fees for enterprise SSO and Directory Sync, and dashboard seats, against ZITADEL on your own infrastructure with PostgreSQL, support, migration and operations.
What Clerk's dashboard export gives you, a CSV with users and hashed passwords, who can run it, what else to pull through the API such as organizations and metadata, and how to check the export before switching providers.
Clerk offers no regional data residency and hosts data in the US. For European products that must keep customer identity data in the EU: what GDPR transfer rules and customer contracts ask for, and running ZITADEL, Keycloak or Ory in an EU datacenter.
For B2B SaaS teams paying Clerk per SAML or OIDC connection as customers ask for SSO: keeping your app login but brokering customer identity providers through Keycloak, or adding Ory Polis for SAML SSO and SCIM directory sync, and what each costs to run.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.