Keycloak vs Auth0 Cost at 5,000 Users: A Three-Year Build or Buy Guide

What is the Keycloak vs Auth0 cost at 5,000 monthly active users?#

In an illustrative 5,000-user scenario priced on 21 October 2026, Auth0 B2B Essentials lists at $1,300 a month against $362.37 for Keycloak on AWS. The difference, $937.63 a month in this illustrative case, is not a saving. Instead, it is the monthly budget that every Keycloak hour must fit inside. That covers patching, upgrades, monitoring, backups and the on-call pager.

The running scenario is a B2B (business-to-business) software company with 4 applications on one shared login. Three of its enterprise customers sign in through their own identity provider. That is the corporate login system, such as Okta or Microsoft Entra. Also, it needs multi-factor authentication (MFA) and role-based access control (RBAC). Every computed figure below is illustrative arithmetic from list prices read on 21 October 2026.

Real projects show the same tension. For example, our Keycloak SSO migration case study, published in March 2026, records authentication support tickets falling 70%, measured on that engagement. In addition, the client reported that its own licence and development cost for authentication fell 40%. However, that second figure is client-reported from the client's own numbers. So treat it as one company's result, not a saving to plan on.

What does 5,000 monthly active users mean when one login serves 4 applications?#

In this illustrative scenario, a person who signs in to all 4 applications through one shared login counts as 1 monthly active user. That holds on every 2026 price page cited below. Therefore 4 applications do not mean 4 times the users, as long as they share one tenant.

However, vendors bill different units. First, Auth0 bills monthly active users. Clerk bills monthly retained users (MRU) instead. Its pricing page, read 21 October 2026, defines the term: "A user is counted as retained when they return 24+ hours after signing up". Meanwhile, WorkOS bills enterprise single sign-on by the connection. Its pricing page, read the same day, says "Each enterprise customer you support with SSO or Directory Sync is counted as one connection".

As a result, the unit that grows a hosted bill is rarely the application. In practice it is the enterprise customer who brings its own identity provider. In the 2026 scenario, that is 3 connections, whatever the number of applications behind the login. Finally, registered users who never sign in during the month count on none of these bills.

Which Auth0 plan does a company with enterprise customers need, and what does it cost?#

Auth0's pricing page, read 21 October 2026, lists B2B Essentials at $1,300 a month for 5,000 monthly active users. A company whose enterprise customers sign in through their own identity providers needs a B2B plan. The reason is simple. The Free plan includes "1 Enterprise Connection", and the B2C plans say "Upgrade to B2B to continue using" them.

On that October 2026 page, B2B Essentials includes "3 SSO Enterprise Connections", RBAC and Pro MFA, which matches the scenario exactly. Meanwhile, the B2B price steps up at every user tier. Also, the B2C plans cost far less for the same count, but they do not cover enterprise customers. That settles the hosted half of Keycloak vs Auth0 pricing.

The B2B line climbs from $300 to $2,100 a month between 1,000 and 10,000 users on Auth0's list, read 21 October 2026.

Source: Auth0 pricing, Monthly billing, read 21 October 2026. List prices change, so check the page on the day you decide.

What does self-hosted Keycloak cost on AWS, line by line?#

At AWS list prices read 21 October 2026, a 3-node Keycloak cluster with Multi-AZ PostgreSQL costs $362.37 a month. Multi-AZ means the database runs in two availability zones, separate data centres in one region. Because Keycloak has no licence fee, its bill is servers, database, load balancer and storage. By contrast, a single node comes to $121.07 a month at the same AWS prices.

Here is the arithmetic, using AWS's own rule that "The Calculator assumes 730 hours in a month". All prices are US East (N. Virginia) On-Demand, read 21 October 2026. Each line is rounded to the cent, while the total uses the unrounded lines:

• Servers: in October 2026, Amazon EC2, the AWS virtual machine service, lists a t4g.large at $0.0672 an hour. So 730 hours is $49.06 per node, or $147.17 for three.
• Database: Amazon RDS for PostgreSQL, the AWS managed database service, lists in October 2026 a db.t4g.large in two zones (Multi-AZ) at $0.258 an hour, or $188.34 a month. A single-zone db.t4g.medium is $0.065 an hour, or $47.45.
• Storage: at AWS's October 2026 rates, the 20 GiB minimum costs $4.60 a month in two zones, or $2.30 in one.
• Load balancer: on the October 2026 AWS list, an Application Load Balancer costs $0.0225 an hour. One load balancer capacity unit (LCU) adds $0.008, so the total is $22.27 a month.

Why three nodes? The Keycloak high availability guide spreads one cluster across availability zones. It also sets a limit: "Deployments require a round-trip latency of less than 10 ms between Keycloak instances". For sizing, the Keycloak CPU and memory guide gives a simple rule. It says "For each 15 password-based user logins per second, allocate 1 vCPU to the cluster". A vCPU is one virtual processor core. Even 5,000 sign-ins packed into one hour is under 2 a second, so small nodes are a fair start. Even so, none of this bill pays the person who keeps it running.

What does each option cost over 36 months before people time?#

In the illustrative scenario at prices read 21 October 2026, 36 months of Auth0 B2B Essentials costs $46,800 against $13,045.43 of Keycloak infrastructure. Over 36 months that list-price gap is large, but it is a ceiling on people time and migration, not a saving. In short, Keycloak total cost of ownership is the server bill plus your hours and the move.

For comparison, WorkOS AuthKit is free up to 1 million users on its pricing page, read 21 October 2026. It charges $125 a month for each of the first 15 SSO connections. For the scenario's 3 connections, WorkOS's October 2026 list comes to $13,500 over 36 months. Then there is Auth0 B2B Professional, at $1,500 a month on Auth0's list read the same day. Over 36 months it comes to $54,000. Finally, a single Keycloak node comes to $4,358.56 over 36 months at October 2026 AWS list prices. However, it has no second zone to fail over to.

The missing term is your own time. So estimate your three-year SSO cost in the model below with your own figures. The defaults are hypothetical and are not vendor quotes.

This model is an estimate for planning, not financial advice.

At what user count does Keycloak break even against Auth0?#

Against Auth0 B2B Essentials prices read 21 October 2026, the monthly budget for Keycloak people time is negative at 1,000 users. At that size Auth0 lists $300 a month. As a result, the illustrative budget sits $62.37 below the three-node AWS bill of $362.37.

From there the budget grows with each Auth0 tier. On Auth0's list read 21 October 2026, it reaches $337.63 at 2,500 users and $937.63 at 5,000. Then it rises to $1,362.63 at 7,500 and $1,737.63 at 10,000. Against B2B Professional on the same October 2026 list, it runs from $437.63 at 1,000 users to $2,037.63 at 10,000.

So the break-even is not a fixed user count. Instead, it is the tier where the budget first covers your monthly hours at your own hourly cost. For example, at a hypothetical loaded cost of $75 an hour, the illustrative $937.63 budget buys about 12.5 hours a month. If patching, upgrades and incident time take more than that, Auth0 stays cheaper at 5,000 users.

Some vendor pages fold people time into one self-hosted figure. For instance, Skycloak, which sells managed Keycloak hosting, argues on its blog, updated March 2026, that teams looking only at hosting fees underestimate the full cost. Splitting the two lines lets you test that claim with your own hours instead.

What does moving existing users off Auth0 cost?#

Auth0's documentation, read 21 October 2026, says not all password hash export requests qualify and gives no export timeline. In its words, "Not all requests qualify for an export". It adds that "Auth0 does not provide ETAs for eligible exports", meaning no estimated date. That one dependency sets the Auth0 to Keycloak migration cost, because it decides whether users keep their passwords.

So before you migrate from Auth0 to Keycloak, ask for the export early. The password hash export page also asks for a support case and a signed form from an executive. Meanwhile, a bulk user export gives you profiles, but not the hashes. Without hashes, users either reset their passwords or move one at a time as they next sign in. In that case both systems run side by side for weeks.

Either way, the people time sits in five places:

• Identity mapping: matching each user, role and organization to a Keycloak realm. A realm is the unit Keycloak uses to hold users and settings.
• Duplicate accounts: the same person under two emails across 4 applications.
• MFA re-enrolment: second factors that do not move need each user to enrol again.
• Testing: every application's sign-in, sign-out and token refresh checked against the new login.
• Cutover: a phased switch, one application at a time, with a way back.

Also, Keycloak can import realms and users as JSON files, a plain text data format, so the load itself is the smaller part. For a worked example, the case study shows existing users moved into one store in phases while the applications kept running. In practice, a phased plan lowers the risk, although no plan can promise that sign-in never stops.

When is self-hosted Keycloak the wrong fit, and when is hosted cheaper?#

At 1,000 users and prices read 21 October 2026, Auth0 B2B Essentials lists below a 3-node Keycloak AWS bill, so self-hosting costs more. Keycloak is the wrong fit in three cases, and each has a better hosted answer.

• The budget cannot cover your hours. If upkeep takes more hours a month than the gap buys at your hourly cost, stay on Auth0. Then spend those hours on the product instead.
• Patching and upgrades have no owner. A login server left without updates is a risk that the gap does not pay for. In that case a hosted plan is the honest choice.
• A free allowance already covers you. Clerk's pricing page, read 21 October 2026, says "Free for your first 50,000 monthly retained users". Its paid plans on that page include 1 SSO connection per app and charge $75 a month for each extra one. Also, WorkOS AuthKit is free to 1 million users on its page read the same day. It then charges $125 a month per SSO connection.

Because both Clerk and WorkOS bill enterprise SSO by the connection, check how many enterprise customers you expect before choosing either. Other hosted identity services exist too, and the same subtraction works for any of them.

Which inputs settle the Keycloak vs Auth0 decision for your company?#

The decision settles on your active users, enterprise connections, operations hours a month, loaded hourly cost and the one-time migration effort. Put each one into the same subtraction, and the Keycloak vs Auth0 cost answer for your company falls out.

1. Input 1

   Active users: your real monthly count across all applications on one login, not registered accounts.

2. Input 2

   Enterprise connections: how many customers sign in through their own identity provider, today and in 36 months.

3. Input 3

   Operations hours: a month of patching, upgrades, monitoring and on-call, measured or honestly estimated.

4. Input 4

   Hourly cost: the loaded cost of the person who does that work, from your own payroll.

5. Input 5

   Migration effort: whether password hashes can be exported, and how many applications need testing.

If any answer is still a guess, measure that one first. For instance, a month of logged hours on a test Keycloak cluster settles the third input better than any vendor page.

Where should a Keycloak migration and cost assessment start?#

A Keycloak migration and cost assessment starts from your identity provider, application count, active users, SSO integrations and whether sign-in must stay online. First, answer the checklist with your own figures. Then read the Keycloak SSO migration case study for how a phased move looked in practice.

The same build-or-buy method applies beyond identity. For instance, our guide to custom software versus off-the-shelf software sets out the general test. Also, our Glean alternatives post runs the same per-user licence arithmetic for an internal artificial intelligence (AI) assistant. For where shared login sits in a larger build, see the enterprise software development guide.

For a second opinion on the numbers, our security and compliance and enterprise software pages describe how an assessment works. Still, the price pages and the Keycloak documentation are enough to make this decision on your own.