Compare / Keycloak vs Zitadel
Keycloak vs Zitadel
Pick Keycloak if you want the published Okta workforce IdP. Pick Zitadel if you want that AGPL identity box. Amazon Cognito (app-user login) stays on /replace/cognito with SuperTokens — not this pair.
Facts checked 22 Oct 2026. License, language, and GitHub activity come from the catalog or the project's own repo. "Not in the catalog row" means the public catalog dump does not store that number.
Keycloak in the catalog Zitadel in the catalog Start on Railway
How they compare
| Keycloak | Zitadel | |
|---|---|---|
| License | Apache License 2.0 (catalog) source | AGPL-3.0 (catalog) source |
| Language | Java (catalog) | Go (catalog) |
| GitHub activity | 37,403 stars in the catalog source | 15,328 stars in the catalog source |
| Self-host | Published as /stacks/keycloak-idp. Workforce IdP. | AGPL identity. Official docs at zitadel.com. |
| Best for | The published Okta replacement. | That Go identity box if Keycloak is more product than you wanted. |
Self-hosting and resource needs
Keycloak is already on /stacks/keycloak-idp and /compare/keycloak-vs-authentik. Zitadel is zitadel/zitadel. Clerk/Auth0/Cognito stay on /stacks/auth-without-the-bill.
FAQ
- Is this Cognito?
- Cognito is customer identity — /replace/cognito (SuperTokens / PocketBase). This pair is an IdP.
- Keycloak or Authentik?
- /compare/keycloak-vs-authentik.
- Are these free?
- Keycloak is Apache License 2.0. Zitadel is AGPL-3.0. You pay hosting.
- How do I deploy Keycloak?
- Open /stacks/keycloak-idp. Persist the database. Create one realm.
Related pages
Stack of the Week
Get one stack a week that replaces a SaaS bill.