Auth0 → Keycloak
What it saves, what actually moves, what you rebuild — and the thing that catches people.
What it costs, and what it saves
Auth0 bills per monthly active user and the B2C tiers escalate quickly past the free 25,000 MAU. A 100,000-MAU app commonly pays four figures monthly. Keycloak is free; you pay for the servers and the operating time.
Moves cleanly
Users, including password hashes — Keycloak can import bcrypt hashes so people are not forced to reset. This is the single most important fact in this migration.
You rebuild
Auth0 Rules and Actions, which have no direct equivalent; Keycloak uses authenticators and mappers.
What Auth0 costs you today
Free plan covers up to 25,000 monthly active users (MAUs) with core login features, 1 Enterprise Connection, and 5 Organizations. Paid B2C plans start at Essentials ($35/month for 500 MAUs, scaling with usage) and Professional ($240/month for 500 MAUs); B2B plans start substantially higher — Essentials at $150/month and Professional at $800/month — because they meter Enterprise SSO connections and Organizations more aggressively. Enterprise tiers are quote-based. Verified directly against auth0.com/pricing, July 2026.
What actually holds you in
User accounts, sessions, and social/enterprise connection configs live in Auth0's cloud tenant. Auth0 supports standard protocols (OAuth2, OIDC, SAML) and offers user-data export, but migrating a live user base to a different auth system still requires a password-reset flow for most users (since password hashes are not portable) and reconfiguring every connected SSO/social provider — a real, if manageable, migration cost.
What you are moving to
Keycloak is a full-featured IAM server originally built by Red Bull's security team and now a CNCF Incubating project. It supports OIDC, OAuth2, and SAML, social and enterprise identity brokering, fine-grained authorization, and a built-in admin console, and it's the most widely deployed self-hosted alternative to Auth0/Okta in production today.
Free / self-host (Docker image or standalone distribution); commercial support available via Red Hat build of Keycloak (RHBK) for enterprises that want a support contract.
Keycloak strengths
- Apache-2.0, fully open-source, no feature gating between a 'community' and 'enterprise' edition
- Extremely mature — 10+ years in production at large scale, CNCF Incubating project with active governance
- Broad protocol support (OIDC, SAML, OAuth2) and identity brokering to external IdPs out of the box
- Large ecosystem of themes, extensions, and Kubernetes operators for production deployment
What you give up
- Runs on the JVM — heavier resource footprint than lightweight Go-based alternatives, and the admin console/config model has a real learning curve
- You own uptime, patching, and database backups for something security-critical — a genuine operational responsibility Auth0 absorbs for you
- Theming the login UI to match a product's brand takes more custom work than Auth0's Universal Login customization
The migration, step by step
- 1Export users from Auth0 including password hashes via their bulk export job
- 2Deploy Keycloak with a proper database — not the dev-mode embedded one
- 3Import users and immediately verify a real password login works
- 4Recreate clients, scopes and mappers; standard OIDC means your application config barely changes
- 5Port Rules and Actions to authenticator flows, then run parallel with a subset of traffic
The gotcha
Keycloak in dev mode looks like it works and is not production-ready. Teams demo it with the embedded database, ship it, and discover the problem during their first restart under load.
When to stay on Auth0
You have no appetite to operate an identity provider — the failure mode is nobody can log in, and that is a different class of incident.
More Layer 5 migrations
Figures verified 2026-07-14 against vendor pricing pages. Prices change and migrations differ by estate — treat the cost delta as a starting model, not a quote. Rankings and recommendations here are merit-only; affiliate income never changes a verdict. See our methodology.