Keycloak alternative to Okta

Keycloak vs Okta

Okta is a closed-source identity suite from a US company, billed per user, per product and per year. SSO and MFA start at $6 per user per month, and most of the rest sits in a higher suite or behind a quote. Cloud-IAM runs open-source Keycloak on a dedicated deployment, from €99 a month for 250 users.

Start for free View pricing

Prices and plans as published on November 5, 2026.

See all our comparisons

What the entry plan includes, for 250 users

Cloud-IAM Starter against Okta Workforce Identity's Starter and Essentials suites, at list price for 250 users.

For customer-facing login, see Keycloak vs Auth0

Cloud-IAM Starter: €99/month, up to 250 users
Okta Starter: $6 per user per month: $1,500/month, billed annually
Okta Essentials: $17 per user per month: $4,250/month, billed annually

Cloud-IAM Starter compared with Okta Starter and Essentials for 250 users, as of 5 November 2026
Pricing
	Cloud-IAM Starter€99/month, up to 250 users	Okta Starter$6 per user per month: $1,500/month, billed annually	Okta Essentials$17 per user per month: $4,250/month, billed annually
Billing	Monthly or yearly	Annual contract, $1,500 minimum	Annual contract, $1,500 minimum
The price grows with	User accounts, in tiers	Every user, for every product	Every user, for every product
Features
SSO (SAML, OpenID Connect) and MFA	Included	Included	Included
Customer and partner logins in the same server	Included	A separate product, Customer Identity	A separate product, Customer Identity
Your own OAuth authorization servers for APIs	Included	Enterprise suite, on quote	Enterprise suite, on quote
Machine-to-machine tokens	Unlimited	Enterprise suite, on quote	Enterprise suite, on quote
Dedicated deployment	Included	Okta's shared cells	Okta's shared cells
Data and independence
Source code	Open source (Apache 2.0)	Closed source	Closed source
Run it on your own servers	Included	Not included	Not included
Password hashes in your export	In every export, up to one a day	Not exported: users reset or migrate at sign-in	Not exported: users reset or migrate at sign-in
Hosting	Your choice: AWS, Google Cloud, Azure, Scaleway, 3DS Outscale	Okta cells in the US, EMEA, Japan, Australia, Canada or India	Okta cells in the US, EMEA, Japan, Australia, Canada or India
Company based in	France	United States	United States
Out of reach of the CLOUD Act	On EU-owned clouds	Not included	Not included
SecNumCloud 3.2 and HDS hosting	On 3DS Outscale	Not included	Not included

Why teams move from Okta to Cloud-IAM

Complete from the first plan

Every paid plan includes all of Keycloak: SSO and MFA, customer and partner logins, OAuth authorization servers for your APIs, unlimited machine-to-machine tokens, and your own login flows and themes. Add your own Java extensions from Essential. On Okta, API Access Management and machine-to-machine tokens need the Enterprise suite, on quote, and customer logins are a separate product.

Open source, nothing on trust

Keycloak's code is public under the Apache 2.0 licence, developed in the open as a CNCF project, and its vulnerabilities are published. Okta's platform is closed source: you take its security on trust.

Out of reach of the CLOUD Act

Okta is a US company, so US law reaches your employees' identities wherever Okta stores them, its EMEA cell included. Cloud-IAM is French, and can run your Keycloak on Scaleway or 3DS Outscale, two European clouds.

Sovereign IAM, out of reach of the CLOUD Act

Leave with your users

Every paid plan exports your realms and users with their password hashes, ready for any Keycloak, including one on your own servers. Okta doesn't export password hashes: leaving means a password reset, or a migration as each user signs in.

Don't take our word for it: read our reviews on Trustpilot

Moving from Okta to Keycloak

Keep Okta as an identity provider
Add Okta to Keycloak as a SAML or OpenID Connect identity provider. Okta doesn't export password hashes, so users keep signing in with their Okta credentials while you move.
Import users and groups
Export users, groups and their attributes through Okta's Users API, and import them into Keycloak, so profiles and access rights move with them.
Recreate your applications
Each application becomes a Keycloak client over SAML or OpenID Connect, with its own roles and login flow, and its sign-in moves from Okta to Keycloak.
Switch Okta off
Once every application has moved, users set a Keycloak password through a reset email, and you can end the Okta contract.

Our consulting team runs these migrations

Frequently asked questions

Weighing Keycloak against Okta for your teams? Our Keycloak engineers will go through your requirements with you.

Talk to a Keycloak engineer

Is Keycloak a good alternative to Okta?

For single sign-on and MFA across applications you control, yes: Keycloak supports SAML 2.0, OpenID Connect, LDAP and Active Directory, passkeys and identity brokering, with no per-user licence. It is not a replacement for Okta's pre-built catalogue of 8,000+ SaaS integrations, its provisioning into those apps, or its governance and device-trust products.

Is Keycloak cheaper than Okta?

Usually, because the software is free and managed Keycloak isn't priced per user per product. For 1,000 employees, Okta's Starter suite lists at $6 per user per month, billed annually, which is $6,000 a month; Cloud-IAM costs from €299 a month for up to 1,000 users.

Is Okta subject to the CLOUD Act?

Yes. Okta, Inc. is a US company, and the CLOUD Act lets US authorities order a US provider to hand over data it controls wherever it is stored, including in Okta's EMEA cell. Cloud-IAM is a French company with no US parent. See what sovereign IAM means at Cloud-IAM.

Can Keycloak replace Okta for employee SSO?

For apps that support SAML or OpenID Connect, yes: each app becomes a Keycloak client, and employees sign in with their directory credentials and MFA. You configure each app yourself rather than picking it from a catalogue, and Keycloak doesn't create accounts inside SaaS apps for you.

Can Keycloak use Okta or Entra ID as an identity provider?

Yes. Keycloak brokers any SAML 2.0 or OpenID Connect identity provider, so it can sit alongside Okta or Microsoft Entra ID during a migration, or permanently for customer and partner logins.

What about Okta Customer Identity?

Okta's customer identity products are Auth0 and the Okta Customer Identity platform. For customer-facing login, see our Keycloak vs Auth0 comparison.

Sources