Skip to main content

Fully Managed Keycloak
as a Service

Deploy Keycloak as a fully managed service starting at €9/mo. Get automated backups, SSL, updates, support and monitoring included.

Keycloak is an open-source identity and access management platform — single sign-on, SAML, OIDC, MFA with passkeys, and fine-grained authorization — combining the convenience of a proprietary identity cloud with the residency and control of self-hosted infrastructure, run by us in the region you choose.

Free 7-day trial  99.9% Uptime SLA  No credit card  Cancel anytime

Free 7-day trial  99.9% Uptime SLA
No credit card  Cancel anytime

Keycloak

Keycloak

STARTING AT

€9/month
Automated Backups
Monitoring
Automated Updates
Auto SSL

USAGE

Unlimited
Human Support
Custom Domains
Terminal Access
File Manager Access
Deploy in your region 21 locations worldwide
GermanyFinlandNetherlandsUKSwedenUnited StatesCanadaSingaporeJapanAustraliaBrazilSouth Africa+9 more →
Keycloak Preview Image

ABOUT THE SOFTWARE

What is Keycloak

Keycloak is an open-source identity and access management platform released under the Apache License 2.0. It originated at Red Hat in 2014 and joined the Cloud Native Computing Foundation in 2020, reaching CNCF Incubating maturity on 10 April 2023. Built on the Quarkus framework with a baseline footprint of around 1,250 MB RAM for 10,000 cached sessions and a 440 MB compressed container image. The corporate steward is Red Hat, which ships a downstream "Red Hat build of Keycloak"; the upstream project is maintained by an open community of contributors.

Keycloak speaks OpenID Connect 1.0, OAuth 2.0, SAML 2.0, the FAPI 2.0 Security Profile, and the UMA 2.0 authorization grant. Public deployments include CERN's single sign-on serving 300,000 users across 13,000 clients with roughly 100 logins per minute during working hours; the Austrian Business Service Portal authenticating 2 million users for 130 public services; and a Japanese pharmaceutical platform onboarding 200,000 users across 750 pharmacies. Production users span healthcare, financial services, public administration, higher education, and B2B SaaS — the same workloads that historically paid an identity cloud and are reconsidering after the 2024–2025 repricing cycle.

FEATURES

What Keycloak does

Keycloak handles single sign-on, identity federation, MFA, and authorization for web apps, mobile apps, APIs, and internal infrastructure. Eight core capabilities cover the typical buyer's checklist, with FAPI 2.0 Final and Passkeys conditional UI arriving in the 26.4 and 26.5 releases shipped in late 2025.

OpenID Connect 1.0

Authorization Code with PKCE, Device Flow, and Client Initiated Backchannel Authentication. The default protocol for new web and mobile apps integrating with Keycloak.

Identity brokering

Federate Google, GitHub, Apple, Microsoft, Facebook, or any generic OAuth 2.0 and OIDC provider. Per-IdP attribute mappers populate the local profile on first login.

WebAuthn & Passkeys

FIDO2 authenticators with conditional UI introduced in Keycloak 26.4. Passwordless flows and step-up authentication for high-assurance operations.

Fine-grained authorization

RBAC, ABAC, and UMA 2.0 policies evaluated by Keycloak's policy engine. Resources and scopes defined per client; decisions returned as RPTs.

SAML 2.0

Identity Provider and Service Provider modes. Auto-import of customer SAML metadata via descriptor URL, with automatic certificate rotation in Keycloak 26.5+.

LDAP & Active Directory federation

Read-only or writable sync against on-prem directories. Built-in group, role, and attribute mappers preserve memberOf semantics in Keycloak.

Multi-factor authentication

TOTP, HOTP, recovery codes, WebAuthn, and per-realm policies that escalate based on risk, location, or authentication context class reference.

FAPI 2.0 & DPoP

FAPI 2.0 Security Profile and Message Signing reached Final in Keycloak 26.4. Required for open banking, PSD2 SCA, and financial-grade APIs.

WHAT'S ALWAYS INCLUDED

Every app. Fully managed.
Nothing extra to pay for.

Every app you deploy includes the full managed service — security, backups, updates, and support from day one.

Automatic updates and patches

Apps run the latest stable version. Security patches applied silently, with rollback if needed.

Daily off-site backups

Multiple daily backups in redundant off-site locations. One-click restore if anything goes wrong.

24/7 uptime monitoring

Continuous monitoring with instant alerting. We respond before you notice.

SSL, firewall, DDoS protection

Auto-renewing SSL, hardened firewall rules, DDoS mitigation on every deployment.

Performance and scaling

We monitor resource usage continuously. When your app needs more headroom, we flag it and upgrade with your explicit approval.

Dedicated engineering support

Real engineers on chat. DNS, SMTP & migration help. All included in €9.

WHY MANAGED

Why teams pick managed Keycloak

Auth0's November 2023 plan rewrite raised B2C Essentials to $35/month for fewer monthly active users and lifted the per-MAU overage rate from $0.023 to $0.07 — a 300% jump. AWS Cognito followed on 1 December 2024, cutting the user-pool free tier from 50,000 MAU to 10,000 MAU. Teams are returning to Keycloak in 2025 and 2026 to control the bill.

Running Keycloak in production is not docker run quay.io/keycloak/keycloak start. It is patching the JVM and PostgreSQL stack every quarter, rotating signing keys on a schedule that doesn't break active sessions, monitoring Infinispan cache health across nodes, backing up the database before each major-version upgrade, and reading every release note to catch the deprecations that bite on upgrade day. None of that work is hard; all of it is recurring, and all of it is what a managed service exists to absorb.

The most-cited example is hostname and reverse-proxy configuration. Since Keycloak 24, KC_PROXY=edge is deprecated; the replacement requires both KC_PROXY_HEADERS=xforwarded and KC_HTTP_ENABLED=true. Operators who set only the first variable end up with broken admin consoles, mis-issued OIDC issuers in the discovery document, and SAML AssertionConsumerServiceURL mismatches that look like Keycloak is broken but are actually a documentation gap. The Keycloak issue tracker has logged this trap explicitly; it is the single most common production failure during upgrades.

We ship Keycloak with hostname, proxy headers, and HTTP enabled wired correctly to our TLS-terminating edge proxy on day one. We pre-tune the database connection pool with KC_DB_POOL_INITIAL_SIZE, KC_DB_POOL_MIN_SIZE, and KC_DB_POOL_MAX_SIZE set to equal values (20/20/20 on the entry plan) against a PostgreSQL configured with max_connections=100, because the Keycloak HA guide is clear that equal sizing keeps connections warm for PostgreSQL's server-side prepared-statement cache. Backups run nightly. Signing keys rotate via the higher-priority-then-passive pattern so active sessions survive.

REVIEWS

Hear from customers ​like you​​​​​​​

Successful businesses and professionals around the world rely on DANIAN every day

USE CASES

Three teams who run Keycloak on DANIAN

These are representative team types we set up most often. Each starts with the same flat €9 plan.

12-PERSON B2B SAAS STARTUP

Replacing Auth0 after the first enterprise SSO quote crossed $480/mo

Germany region. One Keycloak realm, three apps (web, API, admin). Identity brokering set up per enterprise customer's SAML metadata URL. Auth0's B2B Essentials capped at 3 enterprise connections; their pipeline showed 8 within 12 months, putting them on a glide path to B2B Professional at $800/mo.

40-PERSON REGTECH FIRM

Consolidating internal employee SSO across six tools onto one OIDC issuer

Six internal tools — GitLab, Grafana, ArgoCD, Vault, an internal data catalog, and Jenkins — federated through one Keycloak realm. LDAP federation against on-prem Active Directory. WebAuthn Passwordless Policy enforced on the engineering-admin group after a SOC 2 readiness assessment flagged shared service accounts.

9-PERSON HEALTH-TECH STARTUP

Hospital partners require EU-only auth data for the pilot to proceed

EU region only, two realms — patients and clinicians — with different password policies. TOTP MFA mandatory on the clinician realm. Audit events retained 365 days via Keycloak's database event store. Patient and clinician identities never leave the EU region the team picked at signup.

COMPARISON

Four ways to run Keycloak

Buyers comparing Keycloak hosting paths usually weigh four options: pay Auth0 for a proprietary identity cloud, self-host on a VPS, run a home server on owned hardware, or pay DANIAN to run it. The math below holds for a typical B2B SaaS team with one production app and modest MAU growth.

 PATH
Starter
~100 MAU
1 app
Growth
~500–1,000 MAU
5 apps or B2B SSO
Scale
5,000+ MAU
10 apps or 5+ SSO
OPS TIME
Proprietary SaaS (Auth0)
Identity cloud, no self-hosting
$0/mo
Free plan, production features gated
$35–$150/mo
B2C Essentials $35; B2B Essentials $150 (3 SSO cap)
$800+/mo
B2B Professional, invoice-only, 5 SSO cap; Enterprise ~$2,500/mo+ per third-party reporting
None
Self-host on a VPS
You run Keycloak; provider runs the VPS
$24/mo
Production-class VPS, 4 GB RAM
$24–$48/mo
Plus ongoing ops time
$48–$96/mo
Plus DB tuning at 25+ realm users, plus HA at scale
4–12 hrs/mo
Home server
(Owned hardware on your network)
$400–$800 one-time
Plus electricity
$400–$800 one-time
Plus electricity
~$1,200 total
Add UPS, redundant disk, plus electricity
6–15 hrs/mo
DANIAN Managed Keycloak
Same Apache 2.0 Keycloak, run by us
€9/mo
Flat across every user count
€9/mo
No MAU charges, no SSO caps
€18/mo
No connection caps, no overage
None

BY INDUSTRY

Keycloak for specific industries

Different industries put different demands on Keycloak: enterprise SSO depth for B2B SaaS, FAPI 2.0 and PSD2 SCA for fintech, eIDAS Levels of Assurance for the public sector, and eduGAIN federation for higher education. The realm configuration and policy set differ for each.

The buyer-side requirement that funds most Keycloak migrations is enterprise customers demanding SAML or OIDC SSO against their corporate IdP (Okta, Azure AD, Google Workspace) before they sign a contract. The operational standard tracked here is SOC 2 Common Criteria CC6.1 (Logical Access).

We configure Keycloak's Organizations feature, GA in 26.0+, so each enterprise customer brings their own IdP into a single realm without realm duplication.

A typical onboarding: the customer sends their Azure AD SAML metadata URL, an ops engineer pastes it into a new Identity Provider entry in the realm, sets the email-domain claim, and the existing OIDC client gains a "Sign in with customer.com" button without code changes. Auth0's B2B Essentials caps at 3 enterprise SSO connections at $150/month; Professional caps at 5 at $800/month. DANIAN-hosted Keycloak has no connection cap.
PSD2 — Directive (EU) 2015/2366 and the Regulatory Technical Standards in Commission Delegated Regulation (EU) 2018/389 — requires Strong Customer Authentication for payment initiation: two or more factors from the categories of knowledge, possession, and inherence.

We bind the FAPI 2.0 Security Profile client policy (fapi-2-security-profile) to OIDC clients serving payment-initiation flows; FAPI 2.0 Security Profile and Message Signing reached Final in Keycloak 26.4 (September 2025).

A typical flow: a payment-initiation client requests an access token using a DPoP-bound JWT, Keycloak enforces FAPI 2.0 client policy (mTLS or private_key_jwt authentication, PAR-only authorization requests, iss validation in response), and step-up authentication triggers when transaction risk crosses a threshold. Keycloak ships native authenticators for all three SCA factor categories: password, WebAuthn or passkey, and biometric-bound passkey.
Regulation (EU) No 910/2014 — eIDAS — Article 8 defines three assurance levels for electronic identification schemes: low, substantial, and high.

We map these to Keycloak's authentication-context class reference via ACR-to-LoA mapping in the realm authentication flow, available for both OIDC acr_values and SAML AuthnContextClassRef.

A typical flow: an e-government client tagged with acr=loa-substantial redirects a citizen to Keycloak, which checks whether the current session already satisfies the LoA; if not, it prompts for the additional factor before issuing the token. Step-up authentication for SAML reached full support in Keycloak 26.4. The Austrian Business Service Portal, operated by Bundesrechenzentrum, runs Keycloak to authenticate 2 million users across 130 public services — one of the largest public-sector Keycloak deployments in production today.
eduGAIN, operated by GÉANT, is the global SAML inter-federation that lets a student or researcher sign into a service at one institution using their home-institution credentials at another.

We configure the Keycloak realm as a SAML Service Provider with the metadata-descriptor URL pointed at the institution's federation aggregate; signing-and-encryption certificate rotation is automated in Keycloak 26.5+. Attribute mappers translate eduPersonPrincipalName, schacHomeOrganization, and eduPersonAffiliation into Keycloak user attributes and roles.

A typical flow: a graduate researcher clicks "Sign in via your institution" in a research portal, hits eduGAIN's discovery service, picks their home university, authenticates against the home IdP, and lands in the portal with their staff@university.edu affiliation already mapped to a Keycloak role. Live federation count: 84 participant federations; nearly 27 million students, researchers, and educators.

FAQ

Frequently asked questions

Everything teams ask before signing up — answered straight, without sales speak.

Three groups: technical setup, migration, and how DANIAN works as a service.

01

Technical and configuration

Open the realm, click Identity Providers, pick Google, GitHub, or Apple from the dropdown, paste the OAuth client ID and secret you generated in the provider's developer console, set the redirect URI shown by Keycloak in the provider, save. The provider button appears on the login page automatically; mappers copy email and given_name claims into the Keycloak user profile.
Use kc.sh export --dir=/export --users=realm_file for a full export including credentials. Passwords export as hashed values (PBKDF2-SHA512 by default) and re-import correctly. The gotcha: importing the same realm twice with --import-realm errors out with "Realm already exists" unless you set --override=true. For master-realm migrations, dump and restore the PostgreSQL database directly.
Use the FreeMarker theme inheritance model: extend keycloak.v2 (the modern theme) and override only the templates you need to change. Themes load from /opt/keycloak/themes/<name>/login. Avoid copying entire templates wholesale — Keycloak seasonal releases evolve the underlying PatternFly UI, and themes that copy old templates verbatim render broken pages. Pin theme version and re-test after each minor version.
In the realm, create a new Client of type saml, paste the customer's Service Provider metadata XML or URL, configure attribute mappers to emit the claims the customer expects (Email Address, Name ID Format). Keycloak signs assertions with the realm's active signing key; the customer downloads Keycloak's IdP metadata from /realms/<realm>/protocol/saml/descriptor and uploads it on their side.
Enable WebAuthn Register and WebAuthn Authenticator flows under Authentication → Flows. Set the realm's WebAuthn Passwordless Policy: signature algorithms, attestation conveyance, residence key. In Keycloak 26.4+, passkeys integrate into the default browser flow with conditional UI — toggle "Enable Passkeys" under Authentication → Policies → WebAuthn Passwordless Policy.
In Realm → User Federation, add an LDAP provider, set Vendor="Active" Directory, Connection URL=ldaps://dc.corp.example.com:636, Bind DN to a service account, Edit Mode READ_ONLY for pure auth or WRITABLE to sync changes back. Use sync settings for periodic full and changed-user imports; map AD memberOf to Keycloak groups via the built-in LDAP Group Mapper.

02

Migration and onboarding

We can activate your app on your own custom domain/subdomain. Examples: mydomain.com, anyword.mydomain.com.
Or, on our randomized free subdomain. Example: 963.apps.danian.cloud
If you wish to use a custom domain/subdomain, select that option when ordering your app (or notify us later). We will send you the required DNS records and if needed, our tech team will modify them for you.
21 datacenter locations across six continents. You choose the region at provisioning. Application data sits in the region you choose; pick whichever is closest to your users or matches your data-residency preference.
Yes. Request a region migration from the dashboard and we run the move in the background. The system emails you when the migration completes; total transfer time depends on data volume but typical instances finish in a few hours. There is no extra charge for a region change.
Yes. Full data export is available at any time, in a portable format you can bring to any infrastructure.
For most B2B SaaS teams, one realm with per-tenant identity-provider entries — or the Keycloak Organizations feature in 26.0+ — is the right answer. Realm-per-tenant scales badly past a few dozen tenants because realm-list operations slow down. Organizations gives you tenant isolation, per-tenant branding, and per-tenant IdP federation inside one realm.

03

Billing, support, and platform

€9 covers everything we do for that app: hardware in the region you choose, daily off-site backups with one-click restore, automatic security patches and version upgrades, 24/7 monitoring, SSL and firewall, and engineering support on Email/LiveChat. There are no setup fees or hidden line items. For more info see our Pricing page.
If you decide to continue, we charge €9/app/month from day 8. If you don't, the trial ends and you can export your data. No card is required for the trial, and we never auto-charge you without explicit consent.
No. The €9/month is flat regardless of how many users log into your app. Add 5 users or 50; the price doesn't change.
24/7 Live chat and email support, both staffed by engineers who run the systems. We handle DNS configuration, SMTP setup, app integrations, performance tuning, troubleshooting, and migration help. Response time is typically under an hour. There is no tier system — every customer gets the same support.
Yes. Cancel from the dashboard. We don't charge a cancellation fee, we don't lock data, and we will export your data to you on request before deletion. data to you on request before deletion.
Every customer instance is backed up daily to a separate region from the primary. We test restores. You can request a restore at any backup point within the retention window — usually 7 days for daily backups.
Your application data sits in the region you choose at provisioning — 21 datacenter locations across six continents. Account-level data (billing, account email, support ticket history) is processed centrally. Application data region is picked by you, per app.
99.9% uptime SLA on every app, every tenant. Service credits are documented at danian.co/service-level-agreement. The status page is located at status.danian.co.
When your tenant approaches the resource ceiling — the base tier holds 1 vCPU/RAM, 30 GB storage — we notify you. Resource upgrades happen with your explicit consent; we will not upgrade your tenant or charge you without it.
We wait. We don't suspend the app or delete your data on the first failed charge. We email you, you fix the card on file, and we continue.
Invoices can be downloaded from the billing dashboard in PDF the day each charge succeeds. EU VAT is added where applicable and the VAT-reverse-charge regime applies for VAT-registered businesses with a valid number.
150+ open-source apps across automation, team chat, file sync, analytics, AI, password management, email marketing, dev tools, project management, smart home, CMS, and federated social. See the full catalog →
Yes. Every instance comes with a web-based terminal and a file manager in your DANIAN management dashboard. Useful for managing your data and customizations.
Resources scale with your usage. If your app needs more vCPU, RAM, or storage, we add it — and we ask first before any change to your plan. €9 is the floor; resource-heavy workloads may price higher, but you'll always know in advance.
Yes. We have both a Partner program and an Affiliate program available. Anybody can sign up.
No contract. No minimum commitment. Cancel anytime from the dashboard with one click. The 7-day free trial requires no credit card. After the trial converts to paid, you can still cancel at any month without notice or penalty.

DEPLOY IN YOUR REGION

21 datacenter locations on six continents

Pick the region closest to your users.

United States, Germany, Finland, Singapore, Australia, Brazil, Canada, Netherlands, UK, Spain, Italy, France, Sweden, Malaysia, India, Japan, Mexico, Poland, South Korea, Chile, South Africa and more coming soon

Global Reach Map

Try managed Keycloak for 7 days

No card. Cancel from the dashboard.