Keycloak alternative to Auth0

Keycloak vs Auth0

Auth0 is a closed-source identity platform owned by Okta, a US company. Its entry plans come without an SLA or a dedicated deployment, and its advanced security is sold as upgrades and add-ons. Cloud-IAM runs open-source Keycloak on a dedicated deployment with a 99% SLA, from €99 a month.

Start for free View pricing

Prices and plans as published on November 5, 2026.

See all our comparisons

What the entry plan includes

Cloud-IAM Starter against Auth0's Free plan and Essentials, its first paid plan, for consumer (B2C) and business (B2B) apps. Auth0 prices by monthly active users; Cloud-IAM by user accounts.

For employee SSO, see Keycloak vs Okta

Cloud-IAM Starter: €99/month, up to 250 users
Auth0 Free: $0, up to 25,000 monthly active users
Auth0 Essentials B2C: $35/month for 500 monthly active users
Auth0 Essentials B2B: $150/month for 500 monthly active users

Cloud-IAM Starter compared with Auth0 Free and Auth0 Essentials B2C and B2B, as of 5 November 2026
Security
	Cloud-IAM Starter€99/month, up to 250 users	Auth0 Free$0, up to 25,000 monthly active users	Auth0 Essentials B2C$35/month for 500 monthly active users	Auth0 Essentials B2B$150/month for 500 monthly active users
Multi-factor authentication and passkeys	Included	Pro MFA factors not included	Included	Included
IP allow and deny lists	Included	Enterprise only	Enterprise only	Enterprise only
Roles and permissions (RBAC)	Included	Not included	Included	Included
Logs exported to your SIEM	Included	No log streaming, 1 day of log retention	1 log stream, 5 days of log retention	1 log stream, 5 days of log retention
Service
Uptime SLA	99%	Enterprise only, on quote	Enterprise only, on quote	Enterprise only, on quote
Dedicated deployment	Included	Not included	Private Cloud: add-on on Enterprise	Private Cloud: add-on on Enterprise
Connections and limits
Enterprise SSO connections (SAML, OIDC, LDAP)	Unlimited	1	Not available	3, then $100/month each, up to 30
Organizations (B2B tenants)	Unlimited	5	10	Unlimited
Your own extensions	Java extensions, unlimited, from Essential (€249/month)	5 Actions (Node.js)	10 Actions (Node.js)	10 Actions (Node.js)
Machine-to-machine tokens	Unlimited	1,000, no add-on	1,000 included, more as an add-on	1,000 included, more as an add-on
Data and independence
Source code	Open source (Apache 2.0)	Closed source	Closed source	Closed source
Run it on your own servers	Included	Not included	Not included	Not included
Password hashes in your export	In every export, up to one a day	Not available on Free	Through a support ticket, with no guaranteed date	Through a support ticket, with no guaranteed date
Hosting	Your choice: AWS, Google Cloud, Azure, Scaleway, 3DS Outscale	Auth0's shared cloud, in one of six regions	Auth0's shared cloud, in one of six regions	Auth0's shared cloud, in one of six regions
Company based in	France	United States, owned by Okta	United States, owned by Okta	United States, owned by Okta
Out of reach of the CLOUD Act	On EU-owned clouds	Not included	Not included	Not included
SecNumCloud 3.2 and HDS hosting	On 3DS Outscale	Not included	Not included	Not included

Why teams move from Auth0 to Cloud-IAM

Complete from the first plan

Every paid plan includes all of Keycloak: MFA and passkeys, roles and permissions, IP allow lists, unlimited enterprise connections and organizations, and your own login flows and themes. Add your own Java extensions from Essential. On Auth0, roles start at Essentials, IP lists need Enterprise, and a private deployment is an Enterprise add-on.

Open source, nothing on trust

Keycloak's code is public under the Apache 2.0 licence, developed in the open as a CNCF project, and its vulnerabilities are published. Auth0's platform is closed source: you take its security on trust.

Out of reach of the CLOUD Act

Auth0 belongs to Okta, a US company, so US law reaches your users' data even in its EU region. Cloud-IAM is French, and can run your Keycloak on Scaleway or 3DS Outscale, two European clouds.

Sovereign IAM, out of reach of the CLOUD Act

Leave with your users

Every paid plan exports your realms and users with their password hashes, ready for any Keycloak, including one on your own servers. Auth0 hands over password hashes only through a support ticket, with no guaranteed date.

Don't take our word for it: read our reviews on Trustpilot

Moving from Auth0 to Keycloak

Export users
Export users through Auth0's Management API. Password hashes aren't in the API: Auth0 provides them as a PGP-encrypted export through a support ticket, not available on the Free plan and with no guaranteed date, so ask early.
Import users with their hashes
Auth0 hashes passwords with bcrypt. With a bcrypt password-hash extension in Keycloak, users keep their passwords.
Recreate the configuration
Applications become Keycloak clients, connections become identity providers, Actions become Keycloak extensions or flows, and your login pages become a Keycloak theme.
Switch applications one at a time
Applications using a standard OpenID Connect library mostly need a new issuer URL and client credentials; those built on Auth0's SDKs need their login code moved to a standard library.

Our consulting team runs these migrations

Frequently asked questions

Planning a move off Auth0? Our Keycloak engineers will go through your setup with you.

Talk to a Keycloak engineer

Is Keycloak a good alternative to Auth0?

For most login, SSO and MFA needs, yes. Keycloak supports OpenID Connect, OAuth 2.0, SAML 2.0, passkeys, FAPI 2.0 and multi-tenant organizations, and it is a CNCF project under the Apache 2.0 licence. What it doesn't give you on its own is hosting and operations, which is what a managed provider such as Cloud-IAM adds.

Is Keycloak cheaper than Auth0?

Usually, as user numbers grow, because the software is free and managed Keycloak isn't priced per active user. On Cloud-IAM, 10,000 user accounts cost from €499 a month; on Auth0, 10,000 monthly active users cost $700 a month on the B2C Essentials plan and $2,100 on B2B Essentials, before the Enterprise plan an SLA requires. Auth0 can cost less when only a small share of your accounts log in each month.

Is Auth0 subject to the CLOUD Act?

Yes. Auth0 has been part of Okta, Inc., a US company, since 2021, and the CLOUD Act lets US authorities order a US provider to hand over data it controls wherever it is stored, including in Auth0's EU region. Cloud-IAM is a French company with no US parent. See what sovereign IAM means at Cloud-IAM.

How do I migrate from Auth0 to Keycloak?

Export users through Auth0's Management API, and request the password hashes through a support ticket, which Auth0 doesn't offer on its Free plan. Import the users into Keycloak with their bcrypt hashes and a password-hash extension, so nobody has to reset their password. Then recreate applications, connections and Actions logic, and switch applications over one at a time. Our consulting team runs these migrations.

Can I self-host Auth0?

No. Auth0 offers its multi-tenant public cloud and Private Cloud deployments on AWS or Azure, both operated by Auth0. Keycloak can run on your own infrastructure, on any cloud, or managed by a provider.

Does Keycloak support Auth0-style Organizations for B2B?

Yes. Organizations have been fully supported since Keycloak 26, and later releases added invitations, organization groups, organization admin roles and identity providers shared across organizations. Keycloak sets no limit on the number of organizations.

Sources