Self-host or subscribe?
Identity is the one system that sees every login, so this decision carries more weight than it does elsewhere in your stack.
Self-host and pay nothing: Keycloak under Apache 2.0 is a full enterprise IAM platform — SSO, identity brokering, user federation, OAuth2 and OpenID Connect, LDAP and Active Directory integration, MFA and fine-grained authorisation. Authentik covers similar ground with a flow-based engine. Both cost only the infrastructure and the operational effort.
Subscribe and skip the operations: Signward at a flat €3–5 per user per month, Ory Network from €29, Hanko from €99, Zitadel from €100. Every one of them keeps processing in Europe.
The middle path is real: Ory, Zitadel, Hanko and Authentik are all open source with a managed option, so you can start hosted and move in-house later without changing product.
What does per-MAU billing actually do to you?
It makes your authentication bill scale with your success in a way you cannot forecast, which is why it appears in so many complaints about Auth0.
Monthly active user pricing charges per user who logged in that month. A consumer application with a seasonal spike, a marketplace with dormant accounts that reactivate, or a B2B product where each customer brings hundreds of occasional users all produce bills that move independently of revenue.
Signward prices flat at €3 to €5 per user per month with no per-MAU billing, aimed at teams of 5 to 500 users, and includes SSO, passkeys via WebAuthn and FIDO2, TOTP multi-factor, custom domains and branding, webhooks, API keys and audit logs in every plan rather than reserving them for higher tiers.
Self-hosting removes the question entirely: with Keycloak or Authentik, ten users and ten million users cost the same licence, which is nothing. What changes is the infrastructure and the operational attention.
How do you actually get rid of passwords?
Passkeys, and Hanko exists specifically to make that a week of work rather than a quarter.
Passkeys built on WebAuthn and FIDO2 replace passwords with a cryptographic credential held by the device and unlocked by a fingerprint, face or PIN. There is nothing to phish, nothing to reuse across sites, and nothing to leak in a breach — which removes the majority of real-world account compromise rather than mitigating it.
Hanko is built passkey-first with drop-in UI components, so the login interface arrives working rather than as a specification to implement, plus fallback authentication methods for users whose devices or habits are not ready. Its Passkey API adds passkeys to an existing authentication system without replacing it, which is the realistic migration path for a product that already has users.
Zitadel and Keycloak also support passwordless flows, and Signward includes passkeys in every plan. Hanko's advantage is that everything else is arranged around this one capability.
What makes an IAM system enterprise-grade?
Four things, and Keycloak is the reference implementation of all of them.
Protocol coverage: OAuth 2.0, OpenID Connect and SAML 2.0, so it federates with everything an organisation already has. Identity brokering and social login let users arrive from external providers, and user federation connects LDAP and Active Directory so the existing directory remains the source of truth rather than being migrated.
Authorisation beyond authentication: fine-grained authorisation services decide what a user may do, not only whether they may log in — the part most lightweight tools omit and most enterprises need.
Adaptive security: multi-factor authentication with conditional policies that step up requirements based on context rather than prompting everyone every time.
Deployment: Keycloak's Quarkus foundation gives fast startup and low memory footprint, with first-class Kubernetes integration and an operator. Red Hat offers a commercially supported build for organisations that need someone to call.
Which architecture suits which team?
The four open-source options differ structurally, and the difference decides how much you end up running.
Ory splits identity into composable services: Kratos for identity and user management, Hydra as a certified OAuth2 and OpenID Connect server, Keto for permissions modelled on Google's Zanzibar, and Oathkeeper as a zero-trust API gateway. You deploy only what you need, which suits API-first architectures and means more moving parts if you deploy everything.
Zitadel is event-sourced, so every change to identity state is an immutable event — giving a complete audit trail by construction rather than by logging — with multi-tenancy built in, which is why B2B SaaS products choose it. Free tier, paid from €100 per month, Swiss-hosted under adequacy rather than EEA jurisdiction.
Authentik uses a flow-based authentication engine where login, enrolment and recovery are configurable flows rather than fixed behaviours, plus an application proxy that puts authentication in front of applications that have none — the reason self-hosters with a mix of legacy and modern services pick it.
Keycloak is the single comprehensive platform: one system, everything included, more to run.
