Auth0 → Keycloak

Auth0 prices by monthly active users, defined on its pricing page as any non-employee user who authenticated during a given month. A team that sees that bill climb with its user count may look at Keycloak, an identity and access management server that costs nothing to license and runs on infrastructure the team controls. The saving is real, but it moves cost from an invoice to engineering time.

Where Auth0 pricing stands

The pricing page splits self-serve plans into B2C and B2B. Both have a Free plan at $0 per month for up to 25,000 MAUs. On B2C, Essentials starts at $35 per month for 500 MAUs and reaches $3,500 at 50,000 MAUs, while Professional starts at $240 per month for 500 MAUs. On B2B, Essentials starts at $150 per month for 500 MAUs and Professional at $800 per month for 500 MAUs. Enterprise on both is quoted by sales. Yearly billing is listed as 11 times the monthly price.

What Keycloak is

• An open-source identity and access management project under the Apache License 2.0, per its GitHub repository.
• A CNCF incubating project, accepted on April 10, 2023, according to the CNCF project page.
• A server that speaks OpenID Connect and SAML 2.0, with user federation to LDAP and Active Directory, social and external identity provider brokering, and fine-grained authorization.
• Available with commercial backing as the Red Hat build of Keycloak, where Red Hat offers production and development support. Red Hat’s product page states no price, so cost comparisons require a quote.

There is no hosted Keycloak from the project itself. You run it, patch it, back it up and scale it.

What migration involves

Start with the data. Auth0’s bulk user export, available from the dashboard or the Management API, is not offered on the Free plan, and the CSV format is limited to 30 fields. Password hashes are handled separately: Auth0 documents a process in which you open a support case, pass an eligibility review, and complete written authorizations before downloading an encrypted file within a three-day window. Not every request qualifies. Without hashes, users must reset their passwords on first login.

Next, the hashes themselves. Keycloak’s administration guide lists argon2, pbkdf2-sha512, pbkdf2-sha256 and a deprecated pbkdf2 as built-in hashing algorithms. Keycloak’s developer guide explains how to add your own hashing algorithm through its provider interfaces, which is the route a team would investigate for hashes in another format. The Admin REST API also documents a partial import endpoint for loading users into a realm.

Protocols are the easier part. Applications that use OIDC or SAML with Auth0 can be pointed at Keycloak clients with new endpoints and keys. The harder part is behavior: logic written as Auth0 Actions has no automatic translation. Keycloak customization happens through its Service Provider Interfaces in Java, with authenticators, protocol mappers, event listeners and a user storage SPI, plus script providers that the guide marks as Preview. Teams should budget to rewrite each custom flow.

For a gradual move, the user storage SPI lets Keycloak consult an external user store, which is one way to build a login-time migration. Keycloak does not document a ready-made Auth0 connector for that, so the work is custom.

The trade-offs

The licence fee disappears, but operations arrive. Someone must run the database, upgrades, high availability, monitoring and security patches, and an outage becomes the team’s problem. Commercial support through Red Hat exists, though its price is not published.

Features that Auth0 packages as a managed service, such as a hosted login experience and prebuilt dashboards for each tenant, require configuration and theming in Keycloak. Multi-tenant B2B models map onto realms or organizations and need design work up front.

At small scale Auth0’s Free plan up to 25,000 MAUs may still cost less than the staff time spent running Keycloak. The case strengthens at higher volumes, where per-MAU pricing compounds, or when data residency and self-hosting are requirements.