Keycloak Alternative for SMBs: When Authentik Is the Better Choice

Table of Contents

• Where Keycloak gets expensive for SMBs
  • Resource hunger that hurts
  • Complexity that slows teams down
  • The upgrade cycle and what it costs
• Authentik: The Modern Alternative
  • Same protocols, less complexity
  • Flow-based authentication: Flexible without code
  • Lightweight in operation
  • Integrates into your existing stack
  • Open source with a clear commitment
• Authentik vs. Keycloak: Direct Comparison
• When Keycloak still makes sense
• Both operated: Managed Authentik and Managed Keycloak
• Conclusion
• Sources

Where Keycloak gets expensive for SMBs

Keycloak is powerful. No question. The open-source IAM system developed by Red Hat has existed for over 13 years, has more than 32,000 GitHub stars [19] and is used worldwide in enterprise environments. It supports OAuth 2.0, OpenID Connect, SAML 2.0, LDAP Federation, Identity Brokering and fine-grained authorization.

That is exactly where the catch lies for smaller organisations: Keycloak was built for large enterprises and behaves that way. If you have those requirements, you get a lot. If you do not, you still pay for them, in operational effort.

Resource hunger that hurts

Keycloak is based on Java and the Quarkus framework. The base RAM usage alone is around 1,250 MB per pod – without load, just for realm caches and sessions [1]. The official recommendation for production container deployments: at least 2 GB RAM limit [2]. In practice, you need more like 3–4 GB once you have a few realms, clients and active sessions.

There's also a known issue: Keycloak tends toward increasing memory consumption over time [4]. JVM tuning with parameters like MaxRAMPercentage, MaxHeapFreeRatio and choosing the right garbage collector is part of daily operations. If you're not familiar with Java internals, you have a problem.

Complexity that slows teams down

The path from docker run to a production-ready Keycloak instance is long. Hostname configuration, TLS setup, reverse proxy integration, database optimization, Infinispan cache tuning – all of this requires deep expertise. The admin console is regularly described as unintuitive [6]. Customizing login pages requires working with complex theme templates, not a modern UI editor.

A TCO analysis by Sirius Open Source puts the operational costs for self-hosting Keycloak over three years at around €142,000 – with a weekly maintenance effort of over three hours [5]. The "free" open-source tool is anything but cheap in practice.

The upgrade cycle and what it costs

Major version upgrades with Keycloak involved breaking changes for a long time. The migration from WildFly to Quarkus from version 17 was a significant disruption [7]; custom themes, SPI extensions and cache configurations had to be adapted, and downtime occurred because internal cache libraries did not get along between versions [8].

That picture is outdated by now, and fairness requires saying so. Since October 2024 Keycloak follows a compatibility policy: breaking changes in minor releases only happen opt-in through feature and API versioning, and removals wait for a major release. The WildFly break dates from 2022 and does not repeat in that form.

What remains is the effort: a major upgrade wants planning, testing and a maintenance window. For an IT team of three to five people who also run the rest of the infrastructure, that is the real question, not the software itself.

Authentik: The Modern Alternative

Authentik is an open-source Identity Provider that launched in 2018 and explicitly positions itself as a simpler, more modern alternative to Keycloak. The project now has over 20,000 GitHub stars [19] and is actively developed – with a clear focus on developer experience and self-hosting.

Same protocols, less complexity

Authentik supports all relevant standards: OAuth 2.0, OpenID Connect, SAML 2.0, LDAP, RADIUS and SCIM. For the vast majority of SMB use cases – SSO for internal applications, MFA for employees, centralized user management – Authentik offers the same feature set as Keycloak.

The crucial difference: you don't need Java expertise to run it. Authentik is written in Python (Django) and Go and designed from the ground up for container deployments.

Flow-based authentication: Flexible without code

The heart of Authentik is the flow system [11]. Instead of rigid configuration screens, you define authentication workflows from individual "stages" – identification, password, MFA, consent – and control them dynamically via policies [12].

A standard login flow consists of three stages: the user identifies themselves (username/email), enters their password, and is logged in. Building on that, you can define context-dependent rules:

• Access from the company network? → Skip 2FA.
• Login from an unknown IP? → Require hardware key.
• New employee? → Automatically assign to the right group.
• Suspicious login reputation? → Show CAPTCHA.

You configure all of this through the admin UI – no code, no YAML files, no Java SPIs.

Lightweight in operation

Authentik server and worker each run at around 375 MB RAM at idle [9]. The complete stack – server, worker, PostgreSQL – runs on 2–3 GB RAM. Since version 2025.10, Redis has been completely dropped as a dependency: caching, tasks and WebSocket connections now run directly via PostgreSQL [13].

For comparison: where Keycloak alone requires 2–4 GB RAM, you can run the entire Authentik stack in the same range.

Integrates into your existing stack

Authentik offers ready-made integration guides for tools that SMBs actually use:

• Proxmox VE: SSO login via OpenID Connect – configurable via CLI or web UI [16]
• OPNsense: Connection as LDAP server via the Authentik LDAP outpost [17]
• Docker / Coolify: Native Docker Compose installation, fits into any container stack [10]
• Traefik / Nginx: Forward auth via the proxy outpost – even for applications that don't support SSO natively
• Grafana, Nextcloud, Gitea, n8n: OIDC integration in minutes

Open source with a clear commitment

Authentik is licensed under the MIT license. The company behind the project (Authentik Security) has committed to never moving features from the open-source version to the enterprise version [15]. The trend goes in the other direction: Remote Access Control (RDP, SSH, VNC via browser) was moved from Enterprise to Open Source in 2025 [14].

Authentik vs. Keycloak: Direct Comparison

When Keycloak still makes sense

Fairness matters: Keycloak isn't bad – it's just built for a different use case. Keycloak remains the right choice when:

• You need multi-domain Active Directory Federation with Kerberos
• You operate hundreds of realms for multi-tenant scenarios in enterprise environments
• Your team has Java expertise and knows the JVM world
• You need Red Hat enterprise support with SLA
• Regulatory requirements (finance, healthcare) demand a system audited over many years

For most SMBs with 20 to 500 employees, a handful of internal applications and the desire for SSO and MFA, Keycloak is more than the use case asks for.

If you are one of the cases above: we operate Keycloak as a managed service too. The operational effort described above then sits with us instead of you. Details are on Managed Keycloak hosting.

Both operated: Managed Authentik and Managed Keycloak

Running Authentik yourself is significantly easier than Keycloak – but it remains an IAM solution that needs ongoing maintenance. Security updates, database management, backups, monitoring, TLS certificates – all of this takes time. How tight that patch cadence can get is shown by the 2026.5 line with five patch releases in two months, broken down in our version matrix of Authentik patch levels.

authhost.de takes this burden off your shoulders. We operate your Authentik instance as a managed service on dedicated infrastructure in Germany:

• Hosted in Germany: Your identity data stays in German data centers. GDPR-compliant, no ifs or buts.
• Automatic updates: We keep your instance current – including security patches and major version upgrades, tested before they reach your system.
• Daily backups: Automated backups with defined recovery times.
• Monitoring & alerting: We monitor availability and performance around the clock.
• DPA & TOMs included: Data Processing Agreement and technical-organizational measures for your compliance requirements.
• Personal support: German-speaking support from a team that uses Authentik productively in their own stack.

From €99.90 per month you get a fully managed Authentik instance. Every feature is included in every size, there is no feature ladder: SSO, MFA, LDAP and RADIUS outposts, application proxy, flows, with no per-user fees. What differs is instance size and support tier.

The same applies to Keycloak, where the instance starts at €149.90 per month because the JVM needs more memory. Switching between the two therefore does not mean switching provider.

You focus on your core business. We make sure your employees can log in securely and conveniently.

→ Managed Authentik | → Managed Keycloak | → Contact

Conclusion

Keycloak was long the only serious open-source option for Identity & Access Management. That has changed. Authentik offers a more modern, lighter-weight and better-maintainable alternative – with the same core protocols, a more intuitive admin interface and a fraction of the operational complexity.

The decision comes down to two questions. Do you need SAML in both roles, AD federation with write-back, identity brokering or realms as a hard tenant boundary? Then Keycloak is right, and the extra effort is justified. Do you need SSO, MFA and central user management for a manageable set of applications? Then Authentik is the more pragmatic choice.

We operate both from Germany, with a data processing agreement and German-speaking support. Choosing a product is therefore not choosing a provider, and a later switch is not a migration to somewhere else.

→ Managed Authentik | → Managed Keycloak

Sources

1. Keycloak Documentation – Memory & CPU Sizing: keycloak.org
2. Keycloak Documentation – Running in a Container: keycloak.org
3. Keycloak Performance Benchmarks (v26.4): keycloak.org
4. Keycloak GitHub – Memory Leak Issue #28671: github.com
5. Sirius Open Source – Problems with Keycloak: siriusopensource.com
6. Descope – The Top 6 Keycloak Alternatives: descope.com
7. Keycloak Documentation – Migration to Quarkus: keycloak.org
8. Cloud-IAM – Keycloak Upgrades (Breaking Changes): cloud-iam.com
9. Authentik GitHub – Idle RAM Usage Issue #17869: github.com
10. Authentik Documentation – Docker Compose Installation: docs.goauthentik.io
11. Authentik Documentation – Flows: docs.goauthentik.io
12. Authentik Blog – Flows, Stages, and Policies: goauthentik.io
13. Authentik Release 2025.10 – Redis dependency removed: goauthentik.io
14. Authentik Blog – Open Source RAC & Pricing Updates: goauthentik.io
15. Authentik Pricing: goauthentik.io
16. Authentik Integration – Proxmox VE: integrations.goauthentik.io
17. Authentik Integration – OPNsense: integrations.goauthentik.io
18. Authentik GitHub Repository: github.com
19. OpenAlternative – Authentik vs Keycloak (GitHub Stats): openalternative.co
20. exensio – Keycloak im Mittelstand: exensio.de