Stacks / Auth
Keycloak / Authentik
SSO you host. Keycloak is Apache-2.0; Authentik's core is MIT — Okta Workforce without the suite meter.
The problem
Okta Workforce Starter is $6/user/month billed yearly; Essentials is $17. Customer Identity starts at $3,000/month billed yearly. Keycloak is the Apache-2.0 IdP (OIDC, SAML, LDAP). Authentik's core is MIT; some directory/PAM features need an Enterprise license — skip those on a self-host. App login (Clerk/Auth0) stays on /stacks/auth-without-the-bill.
Replaces
Okta
Estimated SaaS saved
$7,200
per year, small team, before lock-in
Start on RailwayAuth without the bill if this is app login, not workforce SSO
Placeholder: Keycloak (Quarkus) + a database, or Authentik + Postgres. This is an IdP, not a login box for one app. App sessions stay on /stacks/auth-without-the-bill.
The stack
Cost table
| You stop paying | Typical / year | Self-host instead |
|---|---|---|
| Okta Workforce Starter (10 seats) | $720 | Keycloak or Authentik |
| Okta Workforce / Customer Identity (small org) | $7,200 | Same IdP; drop the suite meter |
Agent setup prompt
Replace Okta with Keycloak (preferred) or Authentik. - Database. Create one realm/tenant, one OIDC client, one test app. Bind HTTP to 0.0.0.0:$PORT. - Authentik: stay on the MIT core. Do not enable Enterprise providers without a license. - App-user login (not workforce SSO) is SuperTokens / PocketBase on /stacks/auth-without-the-bill. - Write AGENT_PROMPT.md.
Also as markdown: /stacks/keycloak-idp.md
FAQ
- Okta or Auth0?
- Auth0 is Okta's customer-login product and already has /replace/auth0 on SuperTokens. This page is workforce SSO and an IdP you run.
- Keycloak or Authentik?
- Keycloak if you want the older, widely-integrated Apache-2.0 IdP. Authentik if you want a slimmer MIT-core box. Pick one.