Open-source Auth0 alternative

Self-hosted Keycloak on AWS

Add single sign-on, social login and user federation to your applications with Keycloak, running from a pre-configured AMI in your own AWS account. User data stays on your infrastructure, with no per-user pricing.

Launch on AWS
  • Ready in 5-10 minutes
  • OIDC, SAML and OAuth2
  • No per-user fees
Keycloak identity and access management deployed on AWS by Meetrix

What is Keycloak?

Keycloak is an Apache 2.0 identity and access management server. It provides single sign-on, social login, identity brokering and LDAP or Active Directory federation for your applications, with every feature available in the open-source project.

What's in the Meetrix Keycloak AMI

The AMI ships Keycloak with an admin account and SSL handled at launch.

How to set up a self-hosted Keycloak server

  1. Launch the stack

    Subscribe on AWS Marketplace and launch the CloudFormation stack with your domain, admin email and admin password.

  2. Point your domain at it

    After 5-10 minutes, create a DNS record with the PublicIp from the stack outputs.

  3. Sign in to the admin console

    Open the DashboardUrl and sign in as admin with the password you set.

  4. Create a realm and client

    Add a realm for your users and a client for each application that should use SSO.

Deploy on AWS

Keycloak server ports

The vendor-recommended security group opens these ports.

ServicePortsProtocol
HTTP and HTTPS80, 443TCP
SSH (administration)22TCP

Keycloak vs Auth0

KeycloakAuth0
LicenceApache 2.0, self-hostedProprietary SaaS
PricingFree, pay only for your serverFree to 25,000 MAU, then paid plans
MFABuilt in, freeGated behind paid tiers
Data locationYour infrastructureOkta's infrastructure
MaintenanceYoursNone, fully managed

Weighing Authentik as well? Read Authentik vs Keycloak →

Keycloak FAQ

What is Keycloak?

An open-source identity and access management server offering SSO, social login, identity brokering, LDAP and Active Directory integration, and user federation.

Is Keycloak free?

Yes. It is Apache 2.0 licensed with every feature in the open-source project. On AWS you pay for the instance and any Meetrix software fee shown on the listing.

How do I sign in the first time?

Open the DashboardUrl from the stack outputs and sign in with the username admin and the AdminPassword you set.

Is Keycloak a good Auth0 alternative?

It is the most established self-hosted one: standards-based, with MFA and SSO included. You run the server yourself instead of paying per monthly active user.

Can I use it for Jitsi Meet SSO?

Yes, through an OIDC adapter that turns a Keycloak login into the JWT Jitsi expects. Our Jitsi Keycloak SSO guide covers the setup.

Which instance size should I choose?

t3a.medium is the recommended starting point.

How is SSL set up?

Automatically when your domain is hosted on Route 53. Otherwise SSH in and run sudo /root/certificate_generate_standalone.sh.

How do I upgrade?

Back up your realm data and configuration, remove the old stack and launch the updated AMI from AWS Marketplace.

Keycloak guides and articles

Need a hand with Keycloak?

We build and run self-hosted identity infrastructure every day, from SSO integrations to user federation. Tell us what you need.

Contact us