Open-source alternative
Replace Okta with Keycloak / Authentik
The best open-source alternative to Okta is Keycloak or Authentik, self-hosted on Railway. SSO you host. Keycloak is Apache-2.0; Authentik's core is MIT — Okta Workforce without the suite meter.
Estimated save $7,200 a year.
Open the stackStart on Railway
How Okta compares
| Okta | Keycloak / Authentik | |
|---|---|---|
| Pricing model | Per-user Workforce suites (annual) or Customer Identity platform | Open-source or fair-code license; you pay the host |
| Hosting | Vendor cloud | Self-hosted on Railway or any VPS |
| Rough monthly cost | Workforce Starter $6/user/mo billed yearly; Essentials $17/user/mo; Customer Identity Enterprise $3,000/mo billed yearly source | Hosting only — no SaaS seat meter in this repo |
- Keycloak
Apache-2.0 identity provider (OIDC, SAML)
- Authentik
MIT-core SSO (Enterprise extras are licensed separately)
FAQ
- Is it free?
- The Keycloak / Authentik licenses are open source or fair-code. You still pay hosting (Railway or any VPS) and any APIs the stack calls. There is no Okta seat or task bill on this path.
- Can I migrate from Okta?
- Yes. Start with the workflows or data you actually use, then cut over. The Keycloak / Authentik stack page has the agent prompt and the cost table; most teams rebuild the slice that matters and leave old Okta links until they expire.
- How do I deploy it?
- Open the Keycloak / Authentik stack, copy the agent prompt, and deploy on Railway (one service, PORT, and a volume when the app needs disk). Placeholder: Keycloak (Quarkus) + a database, or Authentik + Postgres. This is an IdP, not a login box for one app. App sessions stay on /stacks/auth-without-the-bill.
- What does this replace?
- Okta. The published small-team estimate on this stack is $7,200 a year.
Related pages
Stack of the Week
Get one stack a week that replaces a SaaS bill.