Does Okta cost more than self-hosting Keycloak?
Okta usually costs more as headcount and the number of Okta suites and add-ons grow, because Okta bills per user. Keycloak is licensed under Apache 2.0, so it carries no per-user license fee, and the self-hosted cost moves to infrastructure, database, people and support. Whether self-hosting is cheaper depends on your user count, your availability requirement and the skills you already have in house. Confirm Okta's suite prices, add-on prices and annual minimum on your own order form and renewal quote, then compare those line items with the self-hosted components below, not with a single headline total.
On the self-hosted side, the one-time costs are design, migration, hardening and building the high availability layout. The recurring costs are the compute for at least two Keycloak nodes, a production database, backups, monitoring, and the staff time for upgrades. Keycloak supports PostgreSQL 14 to 18 in production, and both supported high availability designs need a synchronously replicated database, so that database is often the largest line item to price. Keycloak also ships four minor releases a year, and the Operator documentation recommends manual approval for updates. If you want a vendor-backed support subscription, such as the Red Hat build of Keycloak, add its fee to the recurring total.
A simple test is to build a three-year model with the same inputs for both options: named users, Okta suites and add-ons, Keycloak nodes, database and backup costs, monthly operations hours, and the support tier you need. Illustratively, a small workforce with no spare platform staff may find a managed subscription cheaper, while a large workforce that already runs Kubernetes and has database administrators may find self-hosting cheaper per user. Ask any implementation partner to price the scope in writing, with the migration, high availability and upgrade effort itemized, so the comparison reflects your environment rather than a generic estimate.
Which Okta cost components have a Keycloak equivalent
This table maps each Okta cost component to the spend or effort it becomes on a self-hosted Keycloak deployment. Fill the Okta column from your signed order form and the Keycloak column from your own infrastructure and staffing plan. The main takeaway is that Keycloak removes the per-user license line but moves hosting, high availability, upgrades and on-call work onto your team or a partner.
| Cost component | Okta side | Keycloak side | One-time or recurring |
|---|---|---|---|
| Core SSO and MFA license | Per-user Okta suite subscription; confirm tier pricing in your quote | Keycloak is Apache 2.0 licensed, so there is no license line item | Recurring for Okta; none for Keycloak |
| Add-on products | Separate charges for Access Gateway, Privileged Access, Identity Governance and Adaptive MFA | Built-in Keycloak features or companion tools, each with its own setup and upkeep | Recurring for Okta; one-time setup for tools |
| Annual contract minimum | Minimum commitment stated in the order form; ask for it in writing | No vendor minimum; cost follows the infrastructure you choose | Recurring |
| Servers and database | Hosting included in Okta's cloud service | Compute for Keycloak nodes plus a supported production database such as PostgreSQL 14 to 18 | Recurring infrastructure |
| High availability nodes | Run by Okta as part of the service | Multiple nodes and a synchronously replicated database, per Keycloak's high availability designs | One-time design; recurring capacity |
| Support subscription | Support tier included in the contract; confirm response terms | Community support is free; Red Hat build of Keycloak is a paid subscription option | Recurring, optional |
| Migration and integration | Vendor or partner fees for setup, if purchased | Internal or partner effort to export users, re-federate applications and rebuild policies | One-time |
| Upgrades and patching | Handled by Okta | Staff time for minor releases, test environments and operator approval steps | Recurring |
| Operations staff | Lower internal administration load | Named owners for uptime, backups, monitoring and on-call coverage | Recurring |
What moves the Okta cost comparison most
Okta pricing and self-hosted Keycloak costs both scale with different inputs, so the same organization can land far apart depending on a few decisions. The cards below show which driver pushes each side up or down and what to confirm before comparing quotes.
User count and external users
Okta bills per user for workforce suites, so headcount is the largest recurring input on that side. Contractors, partners and other external identities may be priced differently, so count them separately. On the self-hosted side, user count mainly affects database sizing, login load and the number of nodes, not a license fee. Ask Okta to confirm how external users are metered in your quote.
Suite and add-on selection
Which Okta suite is licensed, and which add-ons sit on top, often matters more than the base user count. Features such as lifecycle automation, governance, privileged access or API access management may each carry separate fees. On the Keycloak side, the equivalent functions are either built in or require separate components, so map each licensed Okta feature to a named open-source component before comparing totals.
Applications and directory sources
Each connected application and each directory, such as Active Directory or LDAP, adds integration work. In Okta, these connections are part of the subscription but may need agents and add-ons. In Keycloak, each client and each user federation provider needs configuration, testing and upkeep. A large application count mostly raises one-time migration and ongoing change effort, so ask your integrator for a per-application estimate in the written scope.
Availability and disaster recovery targets
Okta carries the availability of its cloud service, so your cost is mainly the dependency risk and any fallback you design. Self-hosting moves that responsibility to you. Keycloak's supported high availability designs require a synchronously replicated database, and a second site adds infrastructure, replication and failover testing. Set your recovery targets first, then price the second site and database tier against them.
Internal skills already on the team
Staff who already run PostgreSQL, Kubernetes, Linux and identity protocols reduce the cost of self-hosting, while a team without that experience will buy outside help. Okta's cost includes this operational burden on its side. Count the hours your team can realistically give to patching, upgrades and incident response, and price any gap as a service. Keycloak upgrades also need planning, since its Operator documentation recommends manual approval for updates.
Number of environments
Test, staging and production each need an identity provider that matches production closely enough to catch broken integrations. Okta often charges for additional tenants or sandboxes, depending on the contract, so confirm how many you need. Self-hosting adds infrastructure for every environment, but it also lets you size lower environments smaller. Ask for the environment count in the quote, and decide whether non-production identity data is masked or synthetic.
How the cost path changes between Keycloak and authentik
Keycloak is licensed under the Apache License 2.0, so the software itself carries no per-user license fee. The cost path is therefore driven by the infrastructure and people that run it. Keycloak supports PostgreSQL 14 to 18, along with MariaDB, MySQL, Microsoft SQL Server, Oracle Database, EnterpriseDB Advanced, Amazon Aurora PostgreSQL and Azure SQL, and the database choice affects both licensing and operations. The documented high availability designs all need a synchronously replicated database, which usually means a database cluster that costs more to run than a single instance. For production support, Red Hat build of Keycloak is Red Hat's supported distribution based on the open source project and replaces Red Hat Single Sign-On.
- License: Apache 2.0 covers the server code with no per-user fee in the project's own terms (source: the keycloak/keycloak GitHub repository).
- Database tier: A production database is required, and a synchronously replicated setup is needed for the supported high availability designs (source: Keycloak database and high availability documentation).
- Operator and upgrades: The Keycloak Operator recommends manual approval mode for updates, so someone must review and schedule each upgrade.
- Supported distribution: Red Hat build of Keycloak adds vendor support on top of the open source project, and its price comes from Red Hat, so request it in writing.
Confirm with Red Hat or another support provider which Keycloak version and database versions their subscription covers before you budget for it.
authentik's core is MIT licensed, but the enterprise directory sits under a separate enterprise license, so the cost path depends on which features you need. The free edition supports OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos and proxy authentication with community support only. The published Enterprise tier is listed at $5 per user per month billed annually, plus $0.02 per external user per month, according to the authentik pricing page. Enterprise Plus starts at $20k annually, also per the pricing page, and adds dedicated support with SLAs, multi-instance support and FIPS compliance. Since release 2025.10, authentik runs on PostgreSQL alone, which removes Redis from the stack but increases the number of PostgreSQL connections, a factor for database sizing.
- MIT core: The free edition covers most protocols at no license charge, with community Discord support only (source: authentik pricing page and LICENSE on GitHub).
- Enterprise per-user price: $5 per user per month billed annually plus $0.02 per external user per month (source: authentik pricing page).
- Enterprise Plus floor: From $20k annually, which includes SLAs and FIPS compliance for FedRAMP requirements (source: authentik pricing page).
- PostgreSQL-only architecture: From 2025.10, Redis is no longer used, and the release notes warn of roughly 50% more PostgreSQL connections after upgrading (source: authentik 2025.10 release notes).
Ask the authentik sales team for a written quote that lists which enterprise features your use case needs, because Entra ID or Google Workspace integrations push you into the paid tier.
The two products shift cost in different directions. Keycloak's software is free under Apache 2.0, so its recurring spend centers on the database, the cluster and the people who run it, plus an optional vendor subscription. authentik's free edition removes the license charge for many features, but the features most enterprises ask for, such as Entra ID integration and privileged access management, sit behind a per-user price or an annual floor. Neither product has an Okta-style annual contract minimum built into the software, so the comparison depends on what each deployment needs in production.
- Recurring license spend: Keycloak has none in its license terms, while authentik Enterprise bills per user per month.
- Support path: Keycloak support comes from Red Hat or another provider, while authentik support comes through its paid tiers.
- Database sizing: Both need PostgreSQL in production, and authentik's connection count rises after 2025.10.
- Operator cost: Both require upgrade planning and staff time, which is usually the largest cost in either path.
Build a side-by-side model with the same user count and the same feature list for each product before you compare totals.
A reliable quote for either product starts with a written scope. Ask each vendor or implementation partner to price the same set of components so the totals are comparable. The main line items are the license or subscription, the database and its high availability layout, the hosting, the migration, the monitoring and backup, and ongoing operations. Some costs are one-time, such as migration and initial hardening, and others recur every year, such as subscriptions, database hosting and patching time. DeployOpen plans and implements self-hosted platforms in the client's own infrastructure and provides fixed-scope quotes that follow from a written scope.
- Subscriptions: Ask for the exact product tier, the user basis and whether external users are counted separately.
- Database: Ask which PostgreSQL version is supported and whether the design needs synchronous replication.
- High availability: Ask which architecture is quoted and how failover is tested.
- Migration and operations: Ask whether re-enrollment, app re-federation and the upgrade schedule are included.
Confirm every version and feature with the vendor in writing before you approve the budget.
How to build the Okta cost model with your own numbers
This sequence turns your current Okta spend and your own user counts into a side-by-side model with Keycloak, covering infrastructure, database, high availability, support, migration and operations over the same period. The result is a comparison you can defend in a renewal discussion or a written quote request.
Pull the current Okta invoice and order form
Ask your finance or procurement team for the current order form, the most recent invoices and the renewal terms, including the contract term, the annual minimum and any true-up or overage clauses. Your Okta account team can also confirm which suite and add-ons are attached to the contract. You are done when you have a single sheet that lists each line item, its unit price as written in the contract, its billing frequency and the renewal date.
List every licensed suite and add-on
Write down each Okta product on the contract, such as the Workforce Identity suite tier, MFA, Privileged Access, Identity Governance, Access Gateway, API Access Management and any workflow or automation packages. For each one, note what your teams actually use, because many organizations pay for modules that are never switched on. You are done when every line on the invoice maps to a named capability and an owner who confirms whether it is in use.
Count active, inactive and external users
Export the active user population using the Okta Password Health report CSV, a filtered List Users API call or the community Rockstar browser extension, as described in Okta's support guidance. Separate employees from contractors, service accounts and external partners, since Okta billing and self-hosted licensing often treat these groups differently. You are done when you have a reconciled count per user type and a note on how the count was produced, so the number can be reproduced at renewal.
Size the self-hosted infrastructure from platform requirements
Use the Keycloak production and high availability documentation to define the node count, CPU and memory per node, and how many instances you need across availability zones. For authentik, the Docker Compose guide's minimum of 2 CPU cores and 2 GB of RAM applies only to test and small-scale setups, so production sizing must be confirmed against your own load tests. Your platform or cloud team should price compute, load balancing, storage, backups and monitoring in your own accounts. You are done when you have a written sizing assumption per environment (production, staging and disaster recovery) with the cloud or data center rates you actually pay.
Price the database and high availability design
Keycloak supports several production databases, including PostgreSQL 14 to 18, and its high availability designs require a synchronously replicated database. Confirm which database your organization already runs and supports, then price the primary, the standby, backups, point-in-time recovery and the operational tooling. Authentik uses PostgreSQL only since release 2025.10, so its database cost follows the same pattern. You are done when you have a database line item with a stated replication model, backup retention and a named owner for database administration.
Add support, migration and operations effort
Commercial support for Keycloak comes from a vendor subscription such as Red Hat build of Keycloak, while authentik Enterprise offers ticket-based support and Enterprise Plus adds SLAs and FIPS compliance. Estimate internal staff time for patching, upgrades, monitoring, on-call and access reviews, plus a one-time migration project covering app re-federation, user export and password or MFA re-enrollment. Where external help is involved, such as a fixed-scope implementation partner, request the scope, deliverables and fee structure in writing. You are done when each recurring and one-time item has a named payer (internal team, vendor or partner) and a stated driver of cost.
Model one-time and recurring costs over the same period
Place both options on one timeline, using the same number of years and the same user count, so that the Okta contract and the self-hosted build are compared on identical terms. Show one-time costs (migration, design, initial hardening, training) separately from recurring costs (licenses, cloud, database, support, staff time) and state the total for each year. Include a sensitivity line for user growth and for the Okta renewal uplift written in your contract. You are done when a single table shows cumulative cost per year for each option and a clear statement of the assumptions behind each row.
Request matching written quotes from each side
Ask Okta for a renewal quote that lists each suite, add-on, user tier and minimum in writing, and ask any self-hosting partner for a quote built from the written scope, with deliverables, timelines and fees stated separately. Ask the Keycloak or authentik subscription provider for the support tier, response targets and what is included. DeployOpen plans and implements self-hosted platforms and follows fixed-scope agreements, so its quote follows from the written scope, not from a published price list. You are done when both quotes use the same user count, the same time horizon and the same list of cost categories, so the comparison holds up in review.
What the migration adds to the first-year cost
The first year carries one-time work that does not appear in any Okta invoice or Keycloak subscription. User export comes first. Okta documents three ways to pull a list of active users: the Okta Password Health report CSV in the Admin Console, a community browser extension, or the List Users API with a filter. The Admin Console report is the quickest route for a small directory, while the API is the better choice when you need group memberships and profile attributes in a repeatable script. Okta's documentation covers the user list, but password hashes are not part of it, so plan for every user to set a new password or enroll again. Ask your Okta administrator and your implementation partner to confirm exactly which attributes export cleanly and which fields need a second pass.
Next, budget for rebuilding what does not move. App integrations, sign-on policies, group rules and MFA enrollment policies are typically recreated by hand in Keycloak clients, client scopes, authentication flows and required actions. Plan a parallel sign-in period in which Okta and Keycloak both serve a pilot group, and agree on the rollback criteria before cutover. For the Keycloak side, the kc.sh export and kc.sh import commands move realms as JSON, but the Keycloak server guide warns that this route has limits as a backup and restore mechanism and that all nodes must be stopped while it runs. That means a planned maintenance window for any export, and a backup strategy built on a database backup of PostgreSQL or your chosen database, with a restore you have actually tested. Confirm the restore path, the recovery time you need, and who signs off on the cutover before work starts.
Questions buyers ask about Okta cost and self-hosting
How much does self-hosted Keycloak cost compared with Okta?
Keycloak's software is free under the Apache License 2.0, so the comparison comes down to components you pay for. On the Okta side, you pay per-user suite fees, any add-on products, and the annual contract minimum. On the Keycloak side, you pay for infrastructure (compute, a production database that Keycloak supports such as PostgreSQL 14 to 18, and load balancing for high availability), staff time for operations and patching, a support subscription if you want one (for example from Red Hat's build of Keycloak), and a one-time migration project. Build a side-by-side model with each line item, mark which lines are one-time and which recur, and compare totals over the contract term rather than per user alone. No public total is given here, so ask your own finance and procurement teams to fill in the numbers for your user count.
How long does an Okta to Keycloak migration take?
The duration depends on scope, not on a fixed formula. The main drivers are the number of applications re-federated over SAML and OIDC, how many users and groups must move, whether the team replaces the Okta AD agent with Keycloak LDAP or Active Directory federation, and how password and MFA re-enrollment is handled. Applications with custom claims, legacy header-based access, or many environments take longer to test. The Keycloak realm export and import commands can move some configuration, but the documentation warns of limitations as a backup mechanism, so plan for rebuilding parts by hand. Ask any implementation partner for a written timeline tied to a fixed scope, with the application list and the cutover approach stated.
What does the internal team need to run Keycloak?
Running Keycloak in production calls for people who can operate it, not only install it. The team needs skills in Linux, containers or Kubernetes, PostgreSQL administration, TLS and certificate management, and identity concepts such as OIDC, SAML and directory integration. Someone must own the upgrade process, which includes checking breaking changes, because Keycloak plans four minor releases a year. Security response, monitoring through the metrics endpoints, backup and restore testing, and on-call coverage also sit with the team. Map these responsibilities to named people before you commit to a timeline, and identify any gaps you would fill through training or an outside partner.
Can our team run the Okta to Keycloak move without outside help?
Some teams can, particularly those with strong Linux, directory and identity skills and time for a parallel run. Others benefit from outside help with the parts that are easy to get wrong: high availability design, which requires a synchronously replicated database for the supported architectures, safe upgrade practices such as manual approval mode for Operator updates, and the re-federation of every application. A self-run project still needs a test plan, a rollback path and a cutover window. Outside help can be scoped to design, implementation, hardening or a retainer for ongoing operations. DeployOpen plans, implements, hardens and supports self-hosted platforms in your own infrastructure, so you can choose which phases to hand over.
What does a Keycloak support subscription actually cover?
Keycloak is free to use, but a support subscription is a separate purchase that adds vendor-backed help. Red Hat's build of Keycloak is one supported distribution based on the open source project and replaces Red Hat Single Sign-On. Before buying, confirm in writing what the subscription includes: response times, which versions receive fixes, how long each version is supported, and whether patches are delivered for the distribution you run. Community support through public channels is free but carries no response commitment. Compare the subscription price against the internal time it would save, since that trade-off decides whether the line item is worth it.
How do Keycloak upgrades affect the budget over time?
Upgrades create recurring effort rather than a recurring license fee. Since Keycloak 26.0, the project has planned four minor releases a year and a major release every two to three years, and it states that breaking changes in a minor release will be opt-in. Each cycle needs staff time for reading release notes, testing realms and clients in a non-production environment, applying the database schema migration (which runs automatically at startup by default or can be applied manually for large deployments), and scheduling a maintenance window. Budget this as a recurring operations line and ask any partner how upgrades are priced under a retainer.
What should we ask for in a fixed-scope quote for this project?
Ask for a written scope that lists every application, directory source, user population and MFA method in the move, and a deliverables list that names each item the partner will produce. Request the assumptions behind the schedule, the acceptance criteria for cutover, and what is excluded, such as application changes on the vendor side. Confirm who owns infrastructure, which database and high availability design is included, how backups and restore tests are handled, and whether knowledge transfer and documentation are part of the price. Ask how change requests are priced and how post-cutover support is offered, either as a separate retainer or a bounded hypercare period. Also ask which compliance evidence the partner prepares, noting that independent auditors, not implementers, issue audit reports.
How DeployOpen scopes a fixed-price Keycloak implementation
DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure. For an Okta replacement, we start from your current Okta contract and suite, your application inventory and your directory, then write down what Keycloak would run, what it would cost you to operate, and what has to be built.
How we scope
- Inventory every Okta suite, add-on and app integration currently billed, so the comparison matches what you actually pay for.
- Confirm the target hosting: your cloud account, data center or air-gapped network, and who owns each component.
- Agree scope, deliverables and timelines in writing before work starts, since most engagements are fixed-scope.
How we build
- Deploy Keycloak on a supported production database such as PostgreSQL, with the high availability design your SLA requires.
- Re-federate SAML and OIDC applications, connect LDAP or Active Directory user federation, and document each client configuration.
- Test login, MFA enrollment, failover and upgrade paths against your application list before any cutover is scheduled.
How we hand over
- Deliver runbooks for backup, realm export, database migration and operator upgrade approval, with the steps written for your team.
- Document the cost model in your environment, including who pays for database, compute, support subscription and staff time.
- Walk your operations and security staff through monitoring, patching and access controls so ownership transfers cleanly.
How we support
- Offer ongoing support, upgrades and continuous security testing as a retainer after handover, scoped in writing.
- Plan Keycloak upgrades on the project's minor release cadence, with testing in a non-production realm before each change.
- Prepare systems, controls and evidence for your compliance assessments, while independent auditors issue any formal attestation.
