Supabase and Keycloak: Why I Recommend This Stack to My Clients – and What It Really Costs

Over the past years, I have guided many technology decisions: for agencies, start-ups and mid-sized companies. Strikingly often, I end up with the same combination: Supabase for the data layer, Keycloak for identities, Next.js for the frontend. Not because it is the most convenient choice, but because it adds up best in the long run.

In this article, I'll show you what the three building blocks do, when you really need Keycloak and what the stack costs. I checked all prices against the official price lists on 22 September 2026: figures based on my own project experience are marked as such.

Every serious web application consists of three layers: data, identities and interface. The stack is cut precisely along these lines.

Supabase takes care of the data layer: a full-fledged PostgreSQL database plus authentication, real-time updates and file storage, all open source. The practical effect is speed: backend infrastructure that used to take weeks is up and running in days. I covered the basics in What is Supabase?

Keycloak takes care of identity management: single sign-on, multi-factor authentication, role models and the connection to directory services such as LDAP or Active Directory. The project is maturing under the umbrella of the Cloud Native Computing Foundation and has been the de facto standard in enterprise environments for years. You'll find an introduction in What is Keycloak?

Together, the two form an architecture that grows with you without you having to buy it all over again. That leaves the third part: the interface.

On to the frontend: for me, Next.js is the logical complement to Supabase and Keycloak, for three reasons.

Add to that freedom of operation: Next.js runs on Vercel just as well as on your own server in Germany. So the frontend doesn't lock you in, while your data and identities live wherever you want them anyway.

The most common question in my consultations: do you even need Keycloak when Supabase ships with its own authentication? The honest answer: often not.

Supabase Auth covers email login, magic links, social logins and multi-factor authentication. On the Pro plan, it now even supports SAML 2.0 SSO for enterprise connections. For a single application with its own user base, that is the simpler and cheaper choice.

I use Keycloak when at least one of these points applies:

And switching is not a one-way street: because both systems speak open standards, you can start with Supabase Auth and move to Keycloak later without rebuilding the frontend.

A rule of thumb: Supabase Auth is the solution for one application. Keycloak is the solution for an application landscape.

When it comes to operations, you have two realistic paths, and you can mix them.

Path one, managed: Supabase Cloud can run in the AWS Frankfurt region if you choose, so your database sits in the EU. The contracting party, however, is Supabase Pte. Ltd. in Singapore, and its sub-processors include US companies such as Supabase, Inc. and AWS. That is why potential access under US law (CLOUD Act) belongs in your risk assessment. Alongside it, you host Keycloak yourself or through a managed provider. This is the path with the least operational effort.

Path two, self-hosting: Both systems run on your own servers, for example at Hetzner in Germany. That gives you maximum control, and many GDPR discussions resolve themselves. Why the place of operation is more than a footnote for European companies is something I explained in my comparison of Supabase and Firebase.

The middle ground I build most often: Supabase Cloud in Frankfurt for the data layer, Keycloak self-hosted at Hetzner. That way, sensitive identity management stays entirely under your own control, while database operations are outsourced.

In all honesty: self-hosting means operational responsibility. Updates, backups, monitoring and security patches don't go away; they're simply in your hands. On top of that, Supabase evolves quickly and its APIs change from time to time: orderly update management is part of the operating routine. If you can cover this neither internally nor through a partner, you're better off with the cloud option.

Now to the question you're probably here for. I'll go through the blocks one by one: licenses, ongoing operations, implementation.

Supabase and Keycloak are licensed under Apache 2.0, Next.js under MIT. There are no license fees, no per-user tiers and no annual vendor negotiations.

The Free plan is enough for prototypes: up to 50,000 monthly active users and a 500 MB database, free of charge. Production projects start on the Pro plan at $25 per month per organization: it includes 100,000 monthly active users, 8 GB of disk space per project, 250 GB of egress and $10 in compute credits for the smallest instance.

You add larger compute tiers per project: $15 for Small, $60 for Medium. The Team plan, with a SOC 2 report and longer backup retention, jumps to $599 per month. I broke down which other items come up in practice in What Supabase really costs in production.

Hetzner raised its cloud prices on 15 June 2026, yet it stays cheap: a CX33 with 4 vCPUs and 8 GB RAM costs €8.49 net per month, the CX43 with 16 GB RAM €15.99, each plus a public IPv4 address. For comparison: before the price round, the CX33 was €6.49, so the increase changes little in the overall calculation. This class is enough for Keycloak plus a mid-sized Supabase instance at the start. For a typical self-hosted production setup, we budget €20 to €50 a month in server costs.

High availability with redundant instances and a separate database layer is a different league: as a ballpark from my projects, I would put it at €150 to €400 a month, depending on the load profile.

The most expensive item isn't on any price list: the initial implementation. Keycloak setup with realms and SSO flows, Supabase integration, security configuration, testing. From my project experience, this comes to between €5,000 and €20,000 in development effort, depending on scope. The difference from managed fees: this is a one-time investment, not a subscription.

A production-ready Keycloak setup typically takes several days the first time. Anyone without identity management experience regularly underestimates this: don't squeeze it in as an afterthought.

To make the numbers tangible, here is a calculation with its assumptions on the table: a B2B customer portal with around 3,000 active users, Supabase Cloud Pro in Frankfurt, Keycloak and Next.js on a server of your own, three hours of maintenance per month at an assumed hourly rate of €125.

That adds up to ongoing costs of around €400 a month, and roughly nine tenths of that is working time. On top comes the one-time initial implementation from the section above. The punchline: the infrastructure is a rounding error. The real cost block is ongoing support, and that is exactly the part you can plan.

Add up implementation, infrastructure and maintenance, and a typical application for a mid-sized company built on this stack lands, in my experience, in the range of €40,000 to €80,000 over three years, depending on complexity. Over the same period, I have regularly seen comparable setups built from proprietary managed services come in well above that, without the data control this stack provides.

If you've ever had to reread the pricing table during a growth spurt on Firebase or Auth0, you know the pattern. The key difference: the costs of this stack fall over time. The costs of usage-based services rise with your project's success.

Radical honesty is part of the deal: there are situations in which I'd advise you against this combination.

If none of these points applies to you, the math almost always works out.

If you're facing exactly this architecture decision right now: we've taken this stack into production several times and know the pitfalls, from realm configuration to row-level security. You can read how we deliver projects like this on our Supabase services page.

Or let's talk about your project directly: Book a no-obligation initial call. We'll go through your requirements and calculate honestly whether the stack pays off for you: with numbers instead of gut feeling.