# Keycloak / Authentik

SSO you host. Keycloak is Apache-2.0; Authentik's core is MIT — Okta Workforce without the suite meter.

**Replaces:** Okta

**Tier:** Medium

## Problem

Okta Workforce Starter is $6/user/month billed yearly; Essentials is $17. Customer Identity starts at $3,000/month billed yearly. Keycloak is the Apache-2.0 IdP (OIDC, SAML, LDAP). Authentik's core is MIT; some directory/PAM features need an Enterprise license — skip those on a self-host. App login (Clerk/Auth0) stays on /stacks/auth-without-the-bill.

## Stack

- [Keycloak](https://www.keycloak.org) — Apache-2.0 identity provider (OIDC, SAML)
- [Authentik](https://goauthentik.io) — MIT-core SSO (Enterprise extras are licensed separately)

## Estimated SaaS cost saved

| You stop paying | Typical / year | Self-host instead |
|---|---:|---|
| Okta Workforce Starter (10 seats) | $720 | Keycloak or Authentik |
| Okta Workforce / Customer Identity (small org) | $7,200 | Same IdP; drop the suite meter |

**About $7,200 / year** on a small team, before you count lock-in.

## Deploy on Railway

Placeholder: Keycloak (Quarkus) + a database, or Authentik + Postgres. This is an IdP, not a login box for one app. App sessions stay on /stacks/auth-without-the-bill.

[Start on Railway](https://c17.io/go/railway/keycloak-idp?from=%2Fstacks%2Fkeycloak-idp.md)

[Auth without the bill if this is app login, not workforce SSO](https://c17.io/stacks/auth-without-the-bill)

## AGENT_PROMPT

```
Replace Okta with Keycloak (preferred) or Authentik.

- Database. Create one realm/tenant, one OIDC client, one test app. Bind HTTP to 0.0.0.0:$PORT.
- Authentik: stay on the MIT core. Do not enable Enterprise providers without a license.
- App-user login (not workforce SSO) is SuperTokens / PocketBase on /stacks/auth-without-the-bill.
- Write AGENT_PROMPT.md.
```

## FAQ

### Okta or Auth0?

Auth0 is Okta's customer-login product and already has /replace/auth0 on SuperTokens. This page is workforce SSO and an IdP you run.

### Keycloak or Authentik?

Keycloak if you want the older, widely-integrated Apache-2.0 IdP. Authentik if you want a slimmer MIT-core box. Pick one.

Source: https://c17.io/stacks/keycloak-idp