Keycloak Alternatives: Authentik, ZITADEL and More

Have Keycloak or Authentik operated in Germany? WZ-IT takes over installation, hosting and operations for Keycloak, Authentik and ZITADEL: updates, backups, monitoring and the connection of your applications. Book an initial consultation

Anyone looking for a Keycloak alternative usually has a concrete friction: legacy applications without OIDC, customers as tenants, a license question or day-to-day operations. This article sets out decision rules and backs them with license files and vendor documentation, as of October 29, 2026.

A note on context: WZ-IT operates Keycloak and Authentik as a service. For ZITADEL and the other projects mentioned, only information from public sources is given here. The existing article Authentik vs. Zitadel compares those two projects directly and is not repeated here. This article takes Keycloak as the starting point.

Table of Contents

1. Short Answer
2. Key Data at a Glance
3. Licenses from the LICENSE Files
4. Standards and Protocols
5. Multi-Tenancy
6. Operations and Resources
7. Extensibility and Configuration Model
8. Other Alternatives
9. Migrating from Keycloak
10. Common Misconceptions
11. Status and Methodology
12. Our Approach at WZ-IT
13. Further Guides
14. Sources

Short Answer

The table gives directions to check, not a recommendation without knowing the applications. The reasoning follows in the sections below.

Key Data at a Glance

The figures come from the GitHub API of the three repositories and their releases, retrieved on October 29, 2026 (Keycloak, Authentik, ZITADEL). Stars say nothing about fitness; they only show how widespread a project is.

Licenses from the LICENSE Files

Two points are often mixed up. First: Authentik is MIT-licensed at its core, but the enterprise features sit in a separate directory under a license that ties production use to a subscription. According to the pricing page, these include the Microsoft Entra ID and Google Workspace integrations, client certificate authentication (mTLS), enhanced audit logging and Radius EAP-TLS; the Enterprise plan costs 5 US dollars per user and month there, billed annually (retrieved Oct 29, 2026). Second: ZITADEL moved from Apache-2.0 to AGPL-3.0 with version 3, announced on March 13, 2025. The project's licensing policy states that checking AGPL obligations is the user's responsibility and that a commercial license is available on request. The AGPL attaches obligations to modifying the software and to offering the modified version over a network; whether a specific project is affected is a question for legal counsel.

Standards and Protocols

The protocol row rarely decides. All three speak OIDC and SAML. The difference lies in the rows below: anyone who has to provision users into connected applications or attach legacy applications through LDAP, RADIUS or a proxy finds these building blocks documented only for Authentik. Keycloak's SCIM interface is listed in the feature list and in the admin documentation for 26.8.

Multi-Tenancy

• Keycloak: According to the documentation, a realm is a space isolated from other realms with its own users, clients, roles and groups. Since Keycloak 26.0, organizations represent customers or partners within a realm: members, groups, invitation links, domains, shareable identity providers and organization-specific claims. The feature is enabled per realm.
• Authentik: Brands apply per domain or domain wildcard and control the appearance and default flows of the instance. The pricing page lists support for multi-instance deployments as a feature of Enterprise Plus. For hard tenant separation, one instance per tenant is, in our assessment, an option.
• ZITADEL: The documentation describes the organization as a vessel for projects and users, comparable to a tenant. Above it sit virtual instances that can be created through the system API, each with its own domain.

A rule follows: the more customers should appear as separate units with their own domain and administration, the more the tenant model points to ZITADEL or to Keycloak with organizations. For a single organization with many applications, the feature carries no weight.

Operations and Resources

The three figures have different bases: Keycloak states the need of one pod with caches and sessions, Authentik the minimum size of a host running all services, ZITADEL the server without its database. A ranking by resource use cannot be derived from them. The claim that an alternative "needs fewer resources" holds only after a test with your own load, especially the number of password logins, because according to the sizing guide Keycloak spends most of its CPU time on password hashing.

For day-to-day operations, updates matter. The upgrade checklist for Keycloak 26.8 describes which breaking changes a Keycloak update brings.

Extensibility and Configuration Model

• Keycloak: Custom logic runs as a Java SPI (Service Provider Interface); themes adapt the interface. Configuration consists of realm, clients, authentication flows and mappers.
• Authentik: Sign-in procedures are assembled from flows and stages, special cases are written as expression policies in Python. Blueprints store the configuration as files and can be exported from an instance.
• ZITADEL: Actions change behavior on specific events. Administration follows the structure instance, organization, project, application.

The choice depends on the skills at hand here: a team with Java experience writes SPIs, a team with Python experience writes expression policies. The sources do not support a general statement about a "better admin interface".

Other Alternatives

Ory is a toolkit: Kratos and Hydra together cover users and token issuance, and the sign-in interface is built inside your own product. Anyone expecting a ready-made administration interface compares with Keycloak, Authentik, ZITADEL or Casdoor instead. Dex and Authelia solve partial tasks and replace Keycloak only where that partial task is the entire need.

Migrating from Keycloak

The critical path is the issuer. Every application that validates ID tokens must be switched to the new issuer URL and new keys. That is the actual migration work, not the user export. For applications that link users through the sub claim: the values are created anew in the target system unless carried over deliberately, so plan a mapping before switching. This point is a conclusion from the OIDC model and not a quote from the vendor documentation.

Practical order: build the target system in parallel, switch one non-critical application first, keep the old Keycloak as a source or fallback, and only then switch the remaining applications. For what SSO and MFA look like for remote access and for AI interfaces, see SSO & MFA for the remote-access portal, NetBird with Authentik or Keycloak and Set up Open WebUI SSO.

Common Misconceptions

• "Keycloak does not support multi-tenancy." Realms have existed for a long time, and organizations have been a supported feature since Keycloak 26.0. Anyone reading the opposite is reading an older state.
• "Authentik is entirely MIT." The core is; authentik/enterprise/ is not.
• "ZITADEL is Apache-2.0." That held up to version 2. Since version 3 the repository is AGPL-3.0-only, with Apache and MIT exceptions for individual directories.
• "The alternative needs fewer resources." The vendor figures measure different things (see above); only a test with your own load is reliable.
• "Switching removes the operating effort." Updates, backups, monitoring and switching the applications remain with any identity provider.

Status and Methodology

As of October 29, 2026. The data basis is the LICENSE files and LICENSING.md of the Keycloak, Authentik and ZITADEL repositories, the GitHub API (version, stars, detected license) for all projects mentioned, the documentation of the three main projects (versions 26.8, 2026.8, v4.20), the READMEs of the other projects, and the pricing and license pages of Authentik and FusionAuth. Statements marked "not found in the docs" are documentation findings, not tests; missing documentation does not prove that a feature is absent. Resource figures are vendor figures with different bases.

The statement on the sub claim during migration and the practical order are conclusions from the standards and our own experience, not from the cited sources. FusionAuth was classified only from its pricing page and license text, not functionally.

Tables and figures may be reused with attribution and a link to this article.

Our Approach at WZ-IT

WZ-IT operates Keycloak, Authentik and ZITADEL as a hosting and operations offering: installation, hosting in Germany or in your own environment, backups and maintenance, migration of existing instances. Monitoring is performed 24/7, and the response to P1 incidents follows the service level. Features that Authentik provides only with an enterprise license, such as the Microsoft Entra ID and Google Workspace integrations, require a license key from the vendor; the license contract is concluded with the vendor, and WZ-IT supports the selection. The choice between the systems is made on the basis of the applications, protocols and tenant model, as described above.

Further Guides

• Authentik vs. Zitadel, the direct comparison of the two projects.
• Keycloak 26.8 Upgrade, checklist with breaking changes.
• SSO & MFA for the remote-access portal, protocols and factors at a glance.
• NetBird with Authentik or Keycloak, connecting the VPN to the identity provider.
• Set up Open WebUI SSO, signing in to the AI interface through OIDC.
• Keycloak operations and hosting, Authentik operations and hosting and ZITADEL hosting.

Keep, replace or extend Keycloak? We sort out applications, protocols and tenant model and operate Keycloak and Authentik in Germany. Book an appointment

Sources

• Keycloak, repository
• Keycloak, LICENSE.txt
• Keycloak Docs, Server Administration (26.8)
• Keycloak Docs, Server Developer Guide
• Keycloak, Features
• Keycloak, Release Notes
• Keycloak, Importing and exporting realms
• Keycloak, Concepts for sizing CPU and memory resources
• Keycloak, Operator Installation
• authentik, repository
• authentik, LICENSE
• authentik, Enterprise LICENSE
• authentik, Pricing
• authentik Docs, Docker Compose
• authentik Docs, Kubernetes
• authentik Docs, OAuth2 Provider
• authentik Docs, SCIM Provider
• authentik Docs, SCIM Source
• authentik Docs, LDAP Provider
• authentik Docs, Brands
• authentik Docs, Automated install (password hash import)
• authentik, Release 2026.5
• authentik Docs, Flows
• authentik Docs, Expression Policies
• authentik Docs, Blueprints
• ZITADEL, repository
• ZITADEL, LICENSE
• ZITADEL, LICENSING.md
• ZITADEL, v3 Announcement
• ZITADEL Docs, Organizations
• ZITADEL Docs, Instances
• ZITADEL Docs, Production Setup
• ZITADEL Docs, Kubernetes
• ZITADEL Docs, Migrate from Keycloak
• ZITADEL Docs, Migrate users
• zitadel-tools, Keycloak migration README
• ZITADEL Docs, SCIM v2.0
• ZITADEL Docs, SAML
• ZITADEL Docs, OIDC Endpoints
• ZITADEL Docs, Actions
• Ory Kratos, repository
• Ory Hydra, repository
• Casdoor, repository
• Dex, repository
• Authelia, repository
• FusionAuth, Customer License Agreement
• FusionAuth, Pricing
• W3C, Web Authentication Level 3