Keycloak vs Okta: Identity Management Without Per-User Fees
Identity management is the one piece of infrastructure every employee touches every day — and the one most companies quietly overpay for. The dominant vendors price identity per user, per month, which means the bill grows with your headcount even though the software does exactly the same job for employee number 900 as it did for employee number 90. This post compares Keycloak and Okta honestly: what each does well, what the two pricing models really mean, and what a migration actually involves.
The Per-User Pricing Trap
Picture the Q4 budget review. Identity management cost $15,000 last year and nobody blinked. But the company grew from 150 to 400 employees, and the renewal lands at nearly triple the price. Nothing about the service changed — same logins, same dashboards, same admin console. The only thing that changed is the number of seats being billed.
This is the per-user pricing trap, and it’s how companies like Okta, Auth0, and Microsoft Entra ID have built billion-dollar businesses.
Here’s the shape of Okta’s workforce plans (list pricing as published at the time of writing — confirm against your renewal quote):
- Okta Workforce Starter: around $6 USD per user/month — SSO and core identity
- Okta Workforce Essentials: around $17 USD per user/month — the fuller suite
- Contract minimum: $1,500 USD per year, regardless of headcount
At 100 employees on the Starter figure, that’s roughly $7,200 USD a year. At 500, about $36,000. At 2,000, around $144,000 — for the same product doing the same job. Negotiated rates run lower, but the direction of the curve doesn’t change.
We’ve written a full deep dive on the numbers — minimums, tier gating, and year-by-year scaling — in Okta pricing in 2026: real costs and a flat-rate way out. Treat that post as the canonical pricing breakdown; this one focuses on the product comparison.
The growth tax
Per-user identity pricing is effectively a tax on success. As your company grows:
- Hire ten people? The identity line rises immediately, before they’ve shipped anything.
- Seasonal workers? You pay for them even if they’re gone in three months.
- Contractors and vendors who need access? They count as users too.
- Acquisition or merger? Your identity cost can double overnight.
- Slow deprovisioning? You’re paying for accounts nobody uses.
What Identity Management Actually Does
A 100-person company typically runs Google Workspace, Slack, GitHub, Jira, Salesforce, AWS, and twenty other SaaS tools.
Without centralised IAM/SSO:
- Every tool has its own username and password
- Employees reuse passwords across tools — the classic breach entry point
- When someone leaves, you have to remember to deactivate them in 30+ places
- Password resets eat a steady stream of help-desk time
With IAM/SSO:
- One login for everything, protected by one strong credential
- Enforced MFA across every connected service
- One account disabled at offboarding revokes access everywhere
- A centralised audit trail for compliance evidence
None of this is controversial. The question is whether the capability should cost a flat amount or scale with every hire.
Keycloak vs Okta: Feature Comparison
Keycloak is the open-source identity platform (Apache 2.0, originally from Red Hat, now a CNCF project) that sits behind a surprising number of commercial identity offerings. Here’s the honest comparison:
| Capability | Keycloak | Okta |
|---|---|---|
| SSO protocols | SAML 2.0, OIDC, OAuth 2.0 — full implementations | SAML 2.0, OIDC, OAuth 2.0 |
| MFA | TOTP, WebAuthn/FIDO2, and passkeys in the base product | Strong MFA available; adaptive/risk-based MFA gated to higher tiers |
| User federation | LDAP and Active Directory federation built in | Directory integrations included; advanced lifecycle features tier-dependent |
| Admin UX | Capable but utilitarian console; assumes a technical operator | Polished SaaS console; gentler learning curve |
| Pre-built integrations | Standards-based — any SAML/OIDC app connects | 7,000+ catalogued integrations, a genuine moat for long-tail SaaS |
| Hosting model | Anywhere — your cloud, on-prem, or fully managed | Cloud-only SaaS |
| Pricing model | Open source, no licence fee; you pay for hosting and operations | Per-user/month, $1,500/yr contract minimum |
| Support | Community, or a managed provider with an SLA | Vendor support tied to your plan |
Two honest caveats. First, Okta’s integration catalogue matters if you run hundreds of long-tail SaaS apps with quirky federation — Keycloak handles anything spec-compliant cleanly, but the odd nonconformist app takes engineering time. Second, Keycloak’s admin experience expects someone technical at the keyboard. That second point is exactly the gap a managed service closes.
Illustrative scenario: a 280-person company leaving Okta
This is a worked example, not a client story — the numbers are list-price math, not a case study.
Take a 280-person company on Okta’s Starter tier at the ~$6 USD list figure. That’s roughly $20,160 USD a year today. The company is hiring about 100 people a year, so at 380 employees the same subscription runs about $27,360, and at 480 about $34,560. Over three years of growth, the at-list outlay approaches $82,000 USD — every dollar of the increase driven by headcount, not by new capability.
The same company on managed Keycloak pays a flat annual amount scoped to its environment — number of applications, federation complexity, and compliance requirements — and that figure stays put while the team grows. The migration itself typically runs six to nine weeks on a parallel-run model: Keycloak comes up alongside Okta, applications move over in risk-ordered batches, and Okta is only decommissioned once every app has been verified on the new platform.
What managed Keycloak costs
We deliberately don’t publish a tier table, because honest pricing depends on your environment: flat annual pricing scoped to your environment — request a quote. What you can count on is the shape of the deal: no per-user component, senior engineers operating the platform (patching, CVE tracking, upgrades, backup and restore drills), and responsive support with priority escalation for incidents.
The full service breakdown — architecture, operations, and the comparison table against Okta, Auth0, and Entra ID — lives on the managed Keycloak service page.
And if you’re also paying per-seat for privileged access management, the same flat-rate logic applies there — see managed Teleport.
FAQ
Is Keycloak a good alternative to Okta?
For most mid-market workforces, yes. Keycloak covers the core of what teams buy Okta for — SSO over SAML and OIDC, MFA including passkeys, and LDAP/AD federation — without per-user licensing. Okta still earns its price for organisations that depend heavily on its 7,000+ integration catalogue or want a fully hands-off SaaS console. If your app estate is standards-based, Keycloak is a genuine peer.
How much does Keycloak cost compared to Okta?
Keycloak itself is free, open-source software; the real cost is hosting and operations. Okta charges per user per month (list pricing as published at the time of writing, starts around $6 USD for Starter and around $17 USD for Essentials, with a $1,500/yr minimum — confirm against your renewal quote). The structural difference is that Keycloak’s cost is flat as you grow, while Okta’s scales with every hire. ThinSky’s managed Keycloak is flat annual pricing scoped to your environment — request a quote.
Is Keycloak hard to run yourself?
It’s straightforward to start and demanding to run well. A production deployment needs clustering, database management, an upgrade cadence, CVE monitoring, backup and restore testing, and someone on the hook when authentication breaks at 9 a.m. Monday. Teams with platform-engineering capacity do run it themselves successfully; teams without it are better served by a managed deployment.
How long does an Okta-to-Keycloak migration take?
For a typical mid-size company with 20–30 SSO-enabled applications, plan for six to nine weeks. The honest variables are custom authentication flows, non-standard apps, and how much testing your change-management process requires. A parallel-run approach — Okta stays live until every application is verified on Keycloak — keeps cutover risk low without compressing the timeline.
Ready to see what identity management costs without the per-user line? Start with the managed Keycloak service page, request a quote scoped to your environment, or email us directly at sales@thinsky.com — we’ll model your renewal against a flat-rate alternative using your actual headcount plan.