Managed Keycloak Hosting — production SSO from $15 a month
A dedicated Keycloak instance on AWS, Azure or GCP, deployed in minutes and kept patched, backed up and monitored by engineers who run identity infrastructure every day. It is standard Keycloak — your realms, your data, no lock-in.
Keycloak on ManageStacks is the self-hosted, open-source Keycloak IAM (from Red Hat) deployed to your own AWS, Azure, or GCP region — priced flat from $15 per instance per month regardless of user count, with SSO via OpenID Connect + SAML, MFA, LDAP/AD federation, social login, and fine-grained authorisation. Materially cheaper than Auth0 or Okta once you're past 1,000 monthly active users, and identity data (users, tokens, sessions) stays in your cloud region.
OIDC · OAuth 2.0 · SAML 2.0
What does Keycloak do, and why do teams deploy it?
Keycloak is the most widely used open-source identity and access management server. It gives every application in an organisation a single sign-on layer — OpenID Connect, OAuth 2.0 and SAML 2.0 out of the box — plus user federation against LDAP and Active Directory, social login, multi-factor authentication and fine-grained authorisation. Teams deploy it to stop rebuilding login, password reset and session handling in every product they ship.
The trade-off is operational. Keycloak is a stateful Java service with a database behind it, three to four major releases a year, and a security surface that cannot be left unpatched. That operational load — not the software, which is free — is what managed Keycloak hosting removes.
What does managed Keycloak hosting cost?
Three flat tiers, per app per month, on infrastructure in your chosen region. No per-user pricing — a realm with 50,000 users costs the same as one with 50.
| Plan | Price | Suited to | Instance | Support |
|---|---|---|---|---|
| Starter | $15/mo | Staging, internal tools, a single realm | 1 vCPU · 2 GB RAM | Business hours |
| Standard | $29/mo | Production SSO for customer-facing apps | 2 vCPU · 4 GB RAM | Priority, next business day |
| Business | $49/mo | High-traffic production, compliance workloads | 4 vCPU · 8 GB RAM | Priority, same day |
| 24×7 SRE retainer | $499/mo | Teams that need a pager answered at 3am | Across all hosted apps | 24×7 on-call |
All plans include TLS, a custom domain, daily backups and version upgrades. Cloud infrastructure runs in your chosen AWS, Azure or GCP region.
Self-hosting Keycloak vs managed — what does it really cost?
The software is free. The engineer-hours are not. Below is what a competent team typically spends keeping one production Keycloak instance healthy, priced at a conservative $100 per engineer-hour.
| Task | Self-hosted | ManageStacks |
|---|---|---|
| Initial deployment & hardening | 8–16 hours (DB, reverse proxy, TLS, realm config) | Included — live in under 30 minutes |
| Version upgrades | 2–4 hours per release × 3–4 releases/year | Included, tested before rollout |
| Security patching (CVEs) | Same-week response expected; unplanned | Included |
| Backups & restore drills | 1–2 hours/month, plus storage | Daily, tested, included |
| Monitoring & alerting | Setup 4–8 hours, then ongoing triage | Included |
| On-call for an auth outage | Your team, whenever it happens | Business-hours response; $499/mo for 24×7 |
| Typical monthly cost | 6–10 engineer-hours ≈ $600–$1,000 + infrastructure | $15/mo, infrastructure included |
Keycloak SaaS vs ManageStacks vs running it yourself
Keycloak has no official vendor cloud, so the hosted route means a third-party SaaS — typically priced per user or per realm. Here is how the three options compare.
| Keycloak SaaS | ManageStacks | Self-hosted (DIY) | |
|---|---|---|---|
| Starting price | ~$99–$500/mo, often per-user tiers | $15/mo flat | $0 software + infrastructure + hours |
| Infrastructure | Vendor's, shared or dedicated | Dedicated, in your chosen cloud region | Yours entirely |
| Custom SPIs & themes | Usually restricted | Full access — it is standard Keycloak | Full access |
| Version control | Vendor decides | Upgrades scheduled with you | You decide, you do the work |
| Exit path | Depends on export support | Full realm export any time | Not applicable |
| Who fixes an outage | Vendor, per SLA | ManageStacks engineers; 24×7 with retainer | Your team |
What do you get on each plan?
| Feature | Starter $15 | Standard $29 | Business $49 |
|---|---|---|---|
| Dedicated Keycloak instance | ✓ | ✓ | ✓ |
| TLS + custom domain | ✓ | ✓ | ✓ |
| Daily backups (30-day retention) | ✓ | ✓ | ✓ |
| Managed version upgrades | ✓ | ✓ | ✓ |
| Uptime monitoring & alerting | — | ✓ | ✓ |
| Staging environment | — | ✓ | ✓ |
| Choice of cloud region | — | ✓ | ✓ |
| High-availability replica | — | — | ✓ |
| Same-day priority support | — | — | ✓ |
What does running Keycloak yourself involve?
A production Keycloak deployment is Keycloak plus everything around it: a PostgreSQL database with its own backup schedule, a reverse proxy terminating TLS, session clustering if there is more than one node, and a monitoring stack watching all of it. Each piece needs configuring once and maintaining forever.
The recurring work is the harder part. Keycloak ships three to four major releases a year, some with breaking changes to themes and SPIs. Security advisories arrive on their own schedule. And because Keycloak is the front door to every connected application, an outage is never a quiet one.
Keycloak key numbers
How long from subscribing to a live instance?
Pick a plan and a region. Checkout takes two minutes; provisioning starts immediately in the chosen AWS, Azure or GCP region.
Instance goes live. Admin credentials and a hosted URL arrive within 30 minutes. Point a custom domain at it whenever ready — TLS is automatic.
Import or build realms. Existing realms import from a standard Keycloak export; migration help is included on Standard and Business plans.
When is self-hosting Keycloak the right answer?
Managed hosting is not always the correct call. Self-host Keycloak when a platform team already runs Kubernetes with on-call rotation — the marginal cost of one more service is genuinely low. Self-host when compliance requires an air-gapped or on-premises deployment that no hosted option can satisfy. And self-host when the deployment depends on heavily customised SPIs that change weekly, because a fast internal build-deploy loop will beat any managed change process.
For everyone else — teams whose engineers have better things to do than shepherd quarterly Keycloak upgrades — managed hosting is cheaper than the hours it replaces.
Which cloud should Keycloak run on — AWS, Azure or GCP?
For Keycloak itself, the honest answer is that it barely matters — it is a portable Java service and performs equivalently on all three. What matters is proximity: run Keycloak in the same cloud and region as the applications that authenticate against it, because every login adds a round trip.
Teams with existing Azure AD estates often pick Azure for network peering; AWS remains the default when there is no prior footprint. All plans support all three, and moving regions later is a scheduled migration, not a rebuild.
Common questions about managed Keycloak
Is Keycloak free?
Yes — Keycloak is open source under the Apache 2.0 licence with no usage limits. What costs money is running it: infrastructure, upgrades, backups and monitoring. Managed hosting charges for that operational work, not the software.
How is this different from a Keycloak SaaS?
A SaaS typically runs a restricted Keycloak on shared infrastructure with per-user pricing. ManageStacks runs standard, unmodified Keycloak on a dedicated instance in your chosen region at a flat monthly price — custom SPIs, themes and full admin access included.
Can an existing Keycloak instance be migrated?
Yes. A standard realm export (users, clients, roles, identity providers) imports directly. Migration assistance is included on Standard and Business plans, including a parallel-run period before DNS cutover.
What happens on major version upgrades?
Each release is tested against a snapshot of the instance first, then scheduled with the account owner. Breaking changes to themes or SPIs are flagged before the upgrade, never discovered after it.
Who owns the data and the instance?
The customer does. A full realm export is available at any time, and cancelling the plan comes with a final export — the deployment moves to self-hosting or another provider without vendor negotiation.
Run Keycloak without carrying the pager
A dedicated instance, live in under 30 minutes, from $15 per month. Cancel any time with a full realm export.