Keycloak · SSO · EU hosting
KeycloakAgency for login and access management
Role model, single sign-on and operations on EU servers – from rollout to predictable upgrades.
Keycloak consulting: one login for all your applications, with no fee per user
Keycloak is open-source software for login and access management: your employees and customers sign in once and are signed in to every connected application. The software costs nothing; what you pay for is rollout and operations. We take care of both: from the role model and connecting your systems to updates on EU servers.
We are a senior team of 7 in Berlin with more than 150 projects behind us. We use Keycloak mainly in customer portals and B2B applications, and we run it ourselves on EU infrastructure. You talk directly to the people who design your role model and connect your applications.
Keycloak isn't always the right answer: for a single app the built-in login is often enough, and in a pure Microsoft environment Entra ID usually fits better. We tell you that in the intro call, even if it occasionally costs us a project.
Typical Keycloak projects
Keycloak fits when several applications need the same login, your user numbers are growing or login data has to stay on servers in the EU.
One login for all applications
Your team signs in once and then works across the portal, internal tools and business applications. When someone leaves the company, you block their access in one place.
Customer portal with roles and tenants
Your customers see only their own data, and their admins manage their own users. The login carries your design instead of the default screen.
Replacing Auth0 or Cognito
The bill per active user is growing faster than your business. You move to a system with no user fee, and your accounts come with you. Keycloak takes over passwords directly or at first login, depending on the source format.
Connecting Active Directory and partners
Your employees use their existing accounts from Active Directory or LDAP. Partners sign in via SAML through their own system, and older applications stay connected.
Login for Supabase on your own server
Passwords, MFA and the user directory sit on your server in Germany, while the application keeps running on Supabase. Row Level Security evaluates the roles from Keycloak.
Taking over an existing Keycloak
Your instance is running, but nobody keeps it up to date. We bring the version current, set up staging and monitoring, and turn upgrades into a quarterly routine.
Your project isn't listed? In a 30-minute intro call we work out which applications to connect, which role model fits and who takes on operations.
Book an intro callWhen Keycloak fits and when we advise against it
First things first: Keycloak saves you the fee per user, but someone has to take responsibility for running it. Whether that pays off depends on your situation, not on the license.
| Your situation | Our recommendation | Why |
|---|---|---|
| Several applications, one login, customers and employees kept separate | Keycloak | Central login with separate tenants (realms), OIDC and SAML included |
| Growing user numbers, and the bill per active user grows with them | Run the numbers for Keycloak | No user fee; against Auth0 it usually pays off from a few thousand B2B users |
| Login data has to stay on servers in the EU | Keycloak self-hosted or with an EU provider | Data location and contract chain stay in your hands |
| A single app with no need for SAML | Built-in login, such as Supabase Auth | Keycloak would be more system than you need |
| Employee login in a pure Microsoft environment | Entra ID | Usually already in place there |
| Nobody should be responsible for updates and availability | SaaS provider or managed Keycloak | An identity system without maintenance is a security risk with an admin console |
Several applications, one login, customers and employees kept separate
- Our recommendation
- Keycloak
- Why
- Central login with separate tenants (realms), OIDC and SAML included
Growing user numbers, and the bill per active user grows with them
- Our recommendation
- Run the numbers for Keycloak
- Why
- No user fee; against Auth0 it usually pays off from a few thousand B2B users
Login data has to stay on servers in the EU
- Our recommendation
- Keycloak self-hosted or with an EU provider
- Why
- Data location and contract chain stay in your hands
A single app with no need for SAML
- Our recommendation
- Built-in login, such as Supabase Auth
- Why
- Keycloak would be more system than you need
Employee login in a pure Microsoft environment
- Our recommendation
- Entra ID
- Why
- Usually already in place there
Nobody should be responsible for updates and availability
- Our recommendation
- SaaS provider or managed Keycloak
- Why
- An identity system without maintenance is a security risk with an admin console
You'll find the detailed comparison with prices under Keycloak, Auth0, Supabase Auth or Entra ID?. What Keycloak does technically is explained in What is Keycloak?.
What you can buy from us
Three clearly defined services: from the role model to day-to-day operations on EU servers.
Concept and rollout
Before the first setting is changed, it's clear who may do what.
Tenants and realms
Customers kept separate from employees.
Roles and groups
Your business reflected in the access model.
Login theme
Logo, colors and emails in your brand.
MFA and passkeys
A second factor where it's needed.
Integration and migration
Your applications and existing accounts come along, and nobody has to start over.
OIDC and SAML
Web apps, portals and older systems.
Active Directory and LDAP
Keep using existing accounts.
Social login and partner SSO
Sign-in via Google or a partner's system.
User migration
From Auth0, Cognito or your own database.
Operations and upgrades
Keycloak doesn't run itself: someone has to keep it current and available.
Hosting in the EU
At Hetzner or in your infrastructure.
High availability
Two nodes, so the login isn't a single point of failure.
Quarterly upgrades
With a staging test and a fixed maintenance window.
Monitoring and backups
Availability, certificates and database dumps.
What a Keycloak project costs
The license costs €0; what you pay for is rollout and operations. All ranges come from our project experience, excluding VAT, and aren't list prices.
| Item | Price range (excl. VAT) | What's included |
|---|---|---|
| Role model and realms | €2,000–6,000 | Tenants, roles, groups, session and token lifetimes |
| Login theme | €1,500–5,000 | Login in your brand, optionally with registration and emails |
| Integration per application | €1,000–3,000 | OIDC or SAML, role mapping, tests |
| SSO and directories | €2,000–8,000 | Active Directory or LDAP, social login, SAML to partners |
| User migration | €2,000–10,000 | Only with an existing user base, depending on data quality and number of applications |
Role model and realms
- Price range (excl. VAT)
- €2,000–6,000
- What's included
- Tenants, roles, groups, session and token lifetimes
Login theme
- Price range (excl. VAT)
- €1,500–5,000
- What's included
- Login in your brand, optionally with registration and emails
Integration per application
- Price range (excl. VAT)
- €1,000–3,000
- What's included
- OIDC or SAML, role mapping, tests
SSO and directories
- Price range (excl. VAT)
- €2,000–8,000
- What's included
- Active Directory or LDAP, social login, SAML to partners
User migration
- Price range (excl. VAT)
- €2,000–10,000
- What's included
- Only with an existing user base, depending on data quality and number of applications
In total: €8,000–20,000 for a focused rollout with a handful of applications, €20,000–60,000 for full portal integration with directory connections and migration.
In operation: around €150–700 a month for servers and maintenance, depending on high availability and scope. Our hourly rate is €125. The full calculation including managed providers is in What does Keycloak really cost?.
Security & compliance
Your customers trust you with sensitive data. We take that responsibility seriously.
Whether it's your data protection officer, your IT security team or a major customer's procurement: when security questions come up, you have solid answers. We build in data protection and security from day one and follow the principles of the Twelve-Factor App. That makes approvals and audits easier and gives you the technical foundation to meet requirements under GDPR, ISO 27001 or HIPAA.
Frameworks whose technical requirements we implement in our projects
- GDPR
- ISO 27001
- HIPAA
- NIS2
Who works on your project
Our senior team in Berlin, from the first draft to production. You talk directly to the people who write your code.
Meet the teamFAQ
Answers to the questions that actually come up in the intro call.