Keycloak Self-Hosted
AdvancedApi OnlySelf-hosted Keycloak: single sign-on, OpenID Connect, and SAML for all your apps, on infrastructure you run.
Published 27 September 2026
About Keycloak Self-Hosted
Keycloak is the open-source identity and access management server maintained under the Cloud Native Computing Foundation. Applications hand sign-in to it over OpenID Connect, OAuth 2.0, or SAML, and receive tokens they verify with any standard library. Users sign in once and move between every app registered in the same realm.
Its strength is federation and policy. Keycloak connects to LDAP and Active Directory, brokers sign-in through Google, GitHub, or a corporate identity provider, and enforces MFA, password policies, and fine-grained authorization from its admin console. Realms separate tenants or environments, and themes brand the login pages.
It's a Java server with real weight. The official sizing guide starts at about 1250 MB of memory per instance, plus roughly 300 MB outside the heap, and plans CPU by login rate. Production mode also expects a configured hostname and correct proxy headers, and gets the admin console off the public internet; most first-deployment problems are in those settings, not in Keycloak itself.
The stack suits organizations that need enterprise single sign-on across many applications, SAML federation with a corporate directory, or identity data that must stay on their own infrastructure, without per-user pricing at any scale.
Key Features
- ✓Single sign-on across applications through OpenID Connect and SAML
- ✓OAuth 2.0 authorization server for APIs and third-party integrations
- ✓LDAP and Active Directory federation, plus social and enterprise identity brokering
- ✓MFA, password policies, and fine-grained authorization from the admin console
- ✓Realms for separating tenants or environments, with themed login pages
- ✓PostgreSQL storing realms, users, clients, and sessions under your control
When to Use Keycloak Self-Hosted
- →Organizations replacing a per-user identity service across many applications
- →Enterprise deployments federating with Active Directory or a SAML identity provider
- →Regulated industries that must keep identity data on-premises
- →Platforms where several apps share one login
- →Internal tool ecosystems unified under one identity provider
Pros
- No per-user cost at any scale
- Complete OpenID Connect and SAML support, so almost any app can integrate
- LDAP, Active Directory, and identity brokering built in
- Identity data never leaves infrastructure you control
Cons
- Heavier than lighter auth servers: about 1250 MB of memory per instance before PostgreSQL
- Realms, clients, and authentication flows take real time to learn
- Hostname, proxy, and admin-exposure settings must be right before production
- High availability means clustering, which adds its own operations
Hosting Options for Keycloak Self-Hosted
Deploy Keycloak Self-Hosted on Hetzner
A flat-rate root VPS from around €4-5/mo whose entry instance has 4 GB of memory, enough for Keycloak's roughly 1.5 GB plus PostgreSQL with room for login bursts. Put a firewall in front that allows only the proxy's ports, so the admin endpoints are never reachable directly.
Deploy Keycloak Self-Hosted on DigitalOcean
A root Droplet with snapshots and a cloud firewall in the panel: about $12/mo for 2 GB, tight for Keycloak plus PostgreSQL, or $24/mo for a comfortable 4 GB. Managed PostgreSQL (from about $15/mo) takes the identity database off the Droplet with point-in-time recovery, the part you can least afford to lose.
Deploy Keycloak Self-Hosted on Hostinger
The budget VPS in the list: the entry KVM plan (about $6.50/mo on a two-year term) has 4 GB of memory, enough for Keycloak and PostgreSQL. It suits a small organization's SSO; teams that need private networking between the identity server and their apps are better served by a cloud with VPCs.
Deploy Keycloak Self-Hosted on Amazon Web Services
An EC2 instance at roughly $25-35/mo for 4 GB, inside the VPC where your applications already run. RDS for PostgreSQL can hold the identity database with automated backups, and an Application Load Balancer with AWS Certificate Manager can terminate TLS; Keycloak then needs http-enabled and the forwarded headers set.
Deploy Keycloak Self-Hosted on Google Cloud Platform
A Compute Engine instance at roughly $25-35/mo for 4 GB, inside the VPC where your applications run. Cloud SQL for PostgreSQL can hold the identity database, and Cloud Load Balancing with Google-managed certificates can terminate TLS; Keycloak then needs http-enabled and the forwarded headers set.
These are highlighted picks. To see all the tools, check the Hosting & Cloud category.
Reverse Proxy Options for Keycloak Self-Hosted
Keycloak Self-Hosted with Traefik
Routes to the Keycloak container from Docker labels and renews Let's Encrypt certificates on its own. Set Keycloak's proxy-headers to xforwarded and http-enabled to true, and route only the /realms/, /resources/, and /.well-known/ paths publicly, keeping /admin/ on an internal entry point.
Keycloak Self-Hosted with Caddy
Automatic HTTPS from a few lines of config, the simplest fit for one Keycloak container. Caddy sends the X-Forwarded headers by default, so setting Keycloak's proxy-headers to xforwarded is enough for correct redirect URLs; add a path matcher to keep /admin/ off the public site.
Keycloak Self-Hosted with NGINX
The proxy most enterprise ops teams already run, with TLS through Certbot. Forward the X-Forwarded headers and set Keycloak's proxy-headers to match, or requests that check their origin come back 403. Location blocks make it straightforward to expose only the public paths and keep the admin console internal.
Self-Hosted PaaS Options for Keycloak Self-Hosted
Keycloak Self-Hosted with Coolify
Free and self-hosted, deploying Keycloak's official image with PostgreSQL beside it and HTTPS through Coolify's bundled proxy. Set the hostname, proxy-headers, and http-enabled options as environment variables in the service; the template's defaults don't know your public address.
Keycloak Self-Hosted with Dokploy
Free and self-hosted, running Keycloak and PostgreSQL behind its bundled Traefik with HTTPS from the dashboard. As with Coolify, set Keycloak's hostname and proxy settings through environment variables, and use scheduled database backups, since the database holds every user and client secret.
Keycloak Self-Hosted Add-ons
Each addition below extends this stack with a capability the base stack works fine without. None are required: include the ones your product actually needs when building this stack, and skip the rest.
Tunnel Add-ons
Add a tunnel when you're self-hosting without a static IP or can't open inbound ports — a home server, a VPS behind restrictive network policies, or anywhere a reverse proxy alone can't reach the internet.
Keycloak Self-Hosted with Cloudflare Tunnel
Makes Keycloak reachable over HTTPS through an outbound-only connection, with no inbound ports or static IP, for an identity server inside a private network. Publish only the public paths through the tunnel, and put Cloudflare Access in front of the admin console if it must be reachable remotely.
Keycloak Self-Hosted with ngrok
The quicker-start tunnel for testing an app's sign-in flow against a Keycloak on your own machine. Set Keycloak's hostname to the tunnel address while testing, since redirect URIs and token issuers are built from it; its free-tier limits suit development only.
Frequently Asked Questions about Keycloak Self-Hosted
Is there a managed Keycloak, or do I have to run it myself?
The Keycloak project offers no hosted service. Red Hat sells a supported build of Keycloak with a subscription, but you still run it, and a few third-party companies host Keycloak as a service. The usual managed alternative is a different product: Clerk is free up to 50,000 monthly retained users per app and Auth0 up to 25,000 monthly active users, and both bill per user beyond that. Self-hosting Keycloak removes per-user pricing entirely and keeps identity data on your servers, at the cost of running a security-critical Java service yourself.
What does the server need to run?
Keycloak's official sizing guide puts one instance at about 1250 MB of memory for the heap and caches, plus roughly 300 MB outside the heap, so plan on about 1.5 GB for Keycloak alone. With PostgreSQL on the same server, 4 GB is the comfortable size and 2 GB is tight. CPU scales with sign-ins: the guide budgets 1 vCPU per 15 password logins a second, since password hashing dominates. A small organization's traffic fits 2 vCPUs easily.
What needs backing up, and how do upgrades work?
PostgreSQL holds everything: realms, users, credentials, clients and their secrets, and signing keys. Back it up on a schedule and test a restore. Keycloak's export command also writes realms to JSON, which is useful for copying configuration between environments but isn't a substitute for a database backup. Keycloak migrates its schema on startup, so upgrading is a new image version; back up first and read the upgrading guide, since major versions change configuration options.
Which Keycloak settings matter behind a reverse proxy?
Three. Set hostname to your public URL, which production mode requires, since redirect URIs and token issuers are built from it. Set proxy-headers to xforwarded or forwarded to match your proxy; without it, requests that check their origin come back 403. If the proxy terminates TLS, set http-enabled to true. Then expose only the public paths (/realms/, /resources/, /.well-known/) and keep /admin/ and the master realm internal or on a separate admin hostname.
Keycloak or BetterAuth for a self-hosted identity server?
Both run your own identity provider for several apps. Keycloak is the mature choice: SAML, LDAP and Active Directory federation, identity brokering, and a full admin console, at the cost of about 1.5 GB of memory and a real learning curve. BetterAuth, run as a dedicated server with its OAuth provider plugin, covers OpenID Connect for TypeScript teams with a much smaller footprint, but ships no admin interface. For one app that just needs logins, neither server is needed: an auth library inside the app is simpler.
Stacks Related to Keycloak Self-Hosted
Strapi Self-Hosted
Infrastructure
Self-hosted Strapi: an open-source headless CMS with PostgreSQL, on a server you control.
Airflow Self-Hosted
Infrastructure
Self-hosted Apache Airflow: the standard data-pipeline scheduler on your infrastructure.
n8n Self-Hosted
Infrastructure
Self-hosted n8n on your own server, with full control over the database, the host, and how it's exposed to the internet.
GitLab Self-Hosted
Infrastructure
Self-hosted GitLab with Docker: your code, your CI, your infrastructure.
Scores
Popularity4/5
Keycloak is the standard answer to self-hosted single sign-on and a long-standing fixture of enterprise Java environments; the name travels well beyond the identity specialty.
Learning Curve5/5
The hardest stack in this family to master: realms, clients, flows, and federation are a discipline of their own, and Keycloak's reputation for complexity is earned.
Flexibility5/5
Single sign-on, OIDC, SAML, social brokering, and LDAP user federation: if an identity standard exists, Keycloak speaks it.
Performance4/5
One mid-size instance handles substantial login volume; the JVM heap and the database behind it are what to watch at scale.
Portability4/5
Every client integration rides on open protocols, and realm exports plus a plain PostgreSQL backend both travel well.
Tools in the Keycloak Self-Hosted Stack
Keycloak Self-Hosted Pricing
Keycloak and PostgreSQL are free and open source, so the recurring cost is a server with room for Keycloak's JVM: $6-35/mo depending on the provider. There's no per-user charge at any scale, which is the comparison that matters: Clerk is free up to 50,000 monthly retained users per app and Auth0 up to 25,000 monthly active users, and both bill per user beyond that. Red Hat's supported build is the one paid option for Keycloak itself.
Keycloak needs about 1250 MB plus roughly 300 MB non-heap per instance; 4 GB fits it with PostgreSQL comfortably, 2 GB is tight.
Apache 2.0, with unlimited realms, users, and clients and no per-user metering.
Traefik, Caddy, NGINX, Coolify, and Dokploy all self-host free, with free Let's Encrypt certificates.
Keycloak Self-Hosted System Requirements
source- RAM
- 1250 MB base per instance (heap plus realm and session caches) and roughly 300 MB non-heap
- CPU
- Load-based: 1 vCPU per 15 password logins per second (official sizing guide)
The official sizing guide targets HA cluster pods and load tests rather than single-server floors, so treat the base memory as one instance's working floor with the stack's PostgreSQL alongside.