Managed IAM hosting
with Authentik, Keycloak and Zitadel.

Your identity, under your control. We operate open source identity providers as dedicated instances: Authentik, Keycloak or Zitadel. You pick the product, we handle updates, backups and monitoring.

From €99.90/month, start your own instance in minutes.

Choose identity provider

Your instance is ready within 5 minutes of ordering in the portal.

Discuss your project with Timo

Hosting alone if that is all you need. Additional help from Timo and the WZ-IT expert network when needed, at reduced hourly and daily rates for hosting customers. Explore expert support

Authentik Dashboard - SSO, Flows & User Management
DPA included
8 Regions Worldwide
Open Source & auditable
24/7 Monitoring
ISO 27001 data centers, plus BSI C5 in DE

authhost is an independent managed hosting provider and is not affiliated with Authentik Security Inc. (USA). Authentik is open-source software – we run it on German infrastructure. Learn more at goauthentik.io.

Three identity providers

Which identity provider should we run for you?

All three are open source, run as a dedicated instance and are billed per plan rather than per user. What differs is what they were built for.

Authentik

The default for mid-sized companies

SSO via OIDC and SAML, MFA with passkeys, LDAP and RADIUS outposts, application proxy. The broadest coverage for mixed application estates.

Managed Authentik

Keycloak

For tenders and group structures

SAML 2.0 as IdP and SP, identity brokering, AD federation with write-back, realms as a tenant boundary. The choice when the requirement list is long.

Managed Keycloak

Zitadel

For software vendors and SaaS

Organizations as a built-in tenant boundary, a complete audit log through event sourcing, API-first. Built for providers serving many customers themselves.

Managed Zitadel

Not sure which one fits? Authentik, Authelia and Keycloak compared

Switching identity provider does not mean switching vendor with us. We run all three.

IAM hosting: pricing and support

Each product has its own pricing page, because operational effort and target audience differ. Billing is per plan everywhere, not per user.

Managed Authentik

from 99.90 €per month, net

The default for mixed application estates.

Pricing and plans

Managed Keycloak

from 149.90 €per month, net

For SAML, AD federation and realms as a tenant boundary.

Pricing and plans

Managed Zitadel

from 99.90 €per month, net

For software vendors with their own tenant structure.

Pricing and plans

All prices are net, plus statutory VAT. This offer is directed exclusively at businesses within the meaning of § 14 German Civil Code, not at consumers. No setup fee, cancel monthly, data processing agreement on every plan. Prices apply to the German region; outside Germany they are higher.

merkaio

authhost and merkaio managed services

authhost is a brand of merkaio. We specialize in operating, developing and managing open-source infrastructure. Identity is just the beginning. Our ecosystem covers the entire stack.

Individual operation, installation or consulting for individual components also available.

ragpertsAI Hosting & RAG SolutionssupacloudDatabase & backend · SupabaseYou are hereauthhostIdentity & Access Management · AuthentikbirdhostVPN & Networking · NetBirdchirphostLoRaWAN & IoT Connectivity · ChirpStackthingshostIoT Platform & Device Management · ThingsBoardpangohostTunneled Reverse Proxy & VPN · Pangolin
Learn more about merkaio

Identity providers for employees and customers

Central SSO for all applications

One login for intranet, cloud apps, DevOps tools and legacy systems. Employees sign in once and access everything.

Customer Identity (CIAM)

User registration, self-service and social login for your SaaS products or customer portals. B2C-ready.

Zero Trust & Conditional Access

Access based on user, device, location and risk. GeoIP detection and impossible travel detection included.

Whyauthhostinstead of self-hosting Authentik?

Authentik is great open-source software. But running an identity provider is business-critical – an outage means nobody can log in. Our expert team handles complete management: from setup through proactive monitoring to immediate incident response.

24/7 Monitoring & Incident Response

An identity provider must run around the clock. An outage means: nobody can log in – all applications stop.

Security Patches & Zero-Day Response

Identity providers are a prime target for attackers. Zero-day vulnerabilities require immediate action – 24/7.

Missing Expert Knowledge

OIDC, SAML, LDAP, flows, outposts, certificates – secure operation requires deep specialist knowledge most IT teams lack.

Hidden Operating Costs

Servers, monitoring, backups, personnel costs, on-call duty – the true costs of self-hosting quickly exceed any managed offering.

First-class Hands-on Support

Personal support from our expert team

Enterprise-Grade Security

Proactive patches, monitoring & incident response

Predictable Costs

One flat rate, no hidden personnel costs

View plans

SSO, MFA and centralized user management

Authentik provides a complete identity platform that outshines commercial alternatives.

Single Sign-On (SSO)

One login for all applications. Supports OAuth2, OpenID Connect, SAML2 and proxy-based authentication.

Multi-Factor Authentication

TOTP, WebAuthn/Passkeys and email OTP. Optional SMS (via Twilio) and Duo. Protect accounts with modern MFA methods.

Remote Access Gateway

Secure access to RDP, SSH and VNC via browser. No VPN needed.

LDAP Outpost

Full LDAP server as an outpost. Seamlessly integrate legacy applications without code changes.

SCIM Provisioning

Automatic user synchronization with external systems. Fully automated user lifecycle.

RADIUS Outpost

Network authentication for VPN, Wi-Fi and switches. Natively integrated into Authentik.

Application Proxy

SSO for applications without native OIDC/SAML support. Protect any web application with Authentik.

Customizable Flows

Configure login, registration and recovery flows via drag-and-drop. No developers needed.

Custom Branding

Login pages with your own logo, colors and text. Your brand, your identity.

Audit Logs & Compliance

Complete logging of all authentication events. Exportable for SIEM integration.

3 steps to your Identity Provider

Your own instance in under 5 minutes. No waiting, no onboarding call.

01

Register & choose a plan

Create your account in the portal, choose the right plan and configure your domain – your own or provided by us.

02

Hit Deploy

One click on Deploy and your dedicated Authentik instance is automatically provisioned – including SSL, outposts and admin access.

03

Connect applications

Connect your applications via OIDC, SAML or Proxy. Your team signs in via SSO – we monitor and update.

View pricing

Your instance is ready within 5 minutes of ordering in the portal.

merkaio portal

From product selection to a running identity instance

Choose the identity provider, instance size and region in the portal. After deployment, continue there with contracts, the data processing agreement, invoices and support.

Example screenshots of the shared merkaio portal using a Birdhost demo instance. The interface shown is in German. Images illustrate the workflow; displayed prices, features and support tiers are not the current pricing for this service.

1

Choose product and region

Select Authentik, Keycloak or Zitadel, set the instance size and choose one of eight regions.

merkaio portal: product selection with birdhost and region choice from Germany to India

Open full-size screenshot

2

Start deployment

Review the domain and order details, then deploy the instance. Price, term and trial conditions are visible beforehand.

merkaio portal: domain selection with automatic subdomain and the deploy button

Open full-size screenshot

3

Manage the instance

Status, credentials, contract, invoices, data processing agreement and support remain available in one portal.

merkaio portal: running birdhost instance with subscription, server location Germany and scheduled maintenance window

Open full-size screenshot

Continue to portal

Your instance is ready within 5 minutes of ordering in the portal.

7-day trial. Credit card required. Automatically becomes a paid subscription unless you cancel beforehand. Cancel monthly.

One account for instances, invoices, the data processing agreement and support. Screenshots come from a demo environment; credentials are masked.

Customers trust managed services by merkaio

The merkaio portal brings managed open-source infrastructure into one place: identity with Authentik, Keycloak and Zitadel, VPN with NetBird, LoRaWAN with ChirpStack, IoT with ThingsBoard, application access with Pangolin, and database and backend with Supabase.

I signed up with chirphost to host a managed ChirpStack instance for a LoRaWAN monitoring service I'm building in the US. The instance was live within minutes of signing up, no provisioning delays or back-and-forth. Great support makes all the difference. I needed to confirm the correct US915 sub-band mapping for my gateway setup and had a few questions about Basics Station with TLS certificates. Timo responded quickly every time and gave clear, specific answers relevant to my configuration. Actual technical guidance from someone who understands the stack. I run a Rakwireless gateway with Dragino sensors through my chirphost instance, and the entire chain has been solid. If you need managed ChirpStack and don't want to deal with self-hosting, this is the right choice.
BG
Brian Guilfoyle
Geigyr LLC · geigyr.com
viachirphost·Managed ChirpStack
PARTNER PROGRAM

Offer Managed Authentik to Your Clients

Are you a system integrator, MSP or IT service provider? We handle operations – you keep the customer relationship.

White-Label

Custom domain, custom configuration. Dedicated instances for each of your clients.

Co-Managed

You handle first-level support. We take care of operations, monitoring and escalation.

Referral

You refer clients and earn a commission. No operational effort.

Discover Partner Program

Questions about managed IAM hosting

Still have questions?

Contact us
Timo Wevelsiep

Managed hosting with direct access to expertise

IAM hosting with a direct point of contact.

Timo Wevelsiep

Founder, merkaio

LinkedIn profile

At authhost, you book managed hosting for Authentik, Keycloak or Zitadel. Discuss instance sizing and operations directly with me, Timo Wevelsiep. We do not currently offer IAM migrations or the transfer of existing users or application integrations.

I have delivered hundreds of complex infrastructure, IoT and networking projects. As managing director of WZ-IT, I bring that experience to your project and can involve our expert network across infrastructure, cloud, IoT and networking.

A clear scope for your operations

We operate your dedicated instance. Your identity workflows, user directories and connected applications remain the responsibility of your team or implementation partner.

Hosting support is subject to the response times and service hours of your selected support tier.

Discuss hosting with Timo

A 15-minute introductory call to discuss your requirements.

Request managed IAM hosting

We operate your dedicated Authentik, Keycloak or Zitadel instance including hosting, updates, monitoring and support. Tell us which applications, user sources and SSO protocols you want to connect. We'll get back to you within 24 hours.

Timo Wevelsiep

Your Contact

Timo Wevelsiep

Founder, merkaio

[email protected]
Discuss your project with Timo

By submitting, you agree to our Privacy Policy.