Identity and SSO · cost comparison
Okta Workforce Identity vs self-hosted Keycloak: what each actually costs
Okta Workforce Identity on the Starter tier against Keycloak running on the smallest server that fits it. Every figure below is computed from the sizing model and the dated prices at the foot of this page, and includes the part most comparisons leave out: your own time.
At 10 people this one is close enough to go either way. The server costs $26.40 a month against $125 for Okta Workforce Identity, but add 1.5 hours a month of your attention and self-hosting lands at $139 and loses. It only wins if your time is genuinely free.
- Okta Workforce Identity
- $125per month, Starter
- Self-hosted
- $139server, backups and your time
- Server and backups
- $26.40Starter 4 GB, 4 GB RAM
- 36-month difference
- $950 extra to self-host
- Break-even
- neverafter $450 of setup time
The same comparison at every team size
Self-hosting has a floor and almost no slope, while per-seat software has no floor and a steep slope. That is the whole story, and it is why the answer flips somewhere in this table rather than being the same for everyone.
| Team size | Okta Workforce Identity | Self-hosted | Without valuing your time | Server needed | 36-month difference |
|---|---|---|---|---|---|
| solo | $125 | $139 | $26.40 | Starter 4 GB (4 GB) | -$950 |
| 5 people | $125 | $139 | $26.40 | Starter 4 GB (4 GB) | -$950 |
| 10 people | $125 | $139 | $26.40 | Starter 4 GB (4 GB) | -$950 |
| 25 people | $150 | $139 | $26.40 | Starter 4 GB (4 GB) | -$50.40 |
| 50 people | $300 | $139 | $26.40 | Starter 4 GB (4 GB) | +$5,350 |
| 100 people | $600 | $139 | $26.40 | Starter 4 GB (4 GB) | +$16,150 |
| 250 people | $1,500 | $139 | $26.40 | Starter 4 GB (4 GB) | +$48,550 |
The balance tips in favour of self-hosting at around 50 people.
Where the self-hosted money actually goes at 10 people
| Line item | Per month | What it is |
|---|---|---|
| Server | $22.00 | Starter 4 GB at VPSServer: 2 vCPU, 4 GB RAM, 80 GB disk |
| Backups | $4.40 | Provider snapshots at 20% of the server price. Skipping this is not a saving, it is a bet. |
| Your time | $112 | 1.5 hours a month of updates, upgrades and the occasional broken thing, at $75 an hour |
| Total | $139 | Plus $450 once, for roughly 6 hours of first-time setup |
Okta Workforce Identity at this size costs $125 a month. 10 seats at $6.00 each, raised to $125 a month because Okta Workforce Identity requires a minimum contract of that value. This is the annually-billed rate, which is what the vendor's page displayed; paying monthly costs more.
What Keycloak needs to run at 10 people
JVM service with PostgreSQL. Memory is dominated by the heap rather than by user count, so cost per user falls steeply as the directory grows. This is the CNCF-backed incumbent.
| Resource | Required | How it is derived |
|---|---|---|
| Memory | 2.5 GB | 2 GB for the stack at rest, plus 2 MB per active user, plus 25% headroom |
| Disk | 10.1 GB | 10 GB base, plus 0.01 GB per user |
| vCPU | 2 | The project's own baseline. For this workload memory runs out before the processor does. |
What you give up, stated plainly
- Uptime is now yours. Okta Workforce Identity has an operations team on call. Self-hosted, a failed upgrade at 18:00 on a Friday is your evening.
- Backups only exist if you test restoring them. The $4.40 line above buys snapshots, not a rehearsed recovery.
- Keycloak is a multi-container stack with a database you have to back up yourself. That is why the maintenance line is 1.5 hours a month rather than zero.
- Feature parity is never exact. Keycloak covers the core of what teams use Okta Workforce Identity for; the long tail of integrations and enterprise controls is where the gap shows.
We are not going to tell you to self-host this
At 10 people, Okta Workforce Identity wins on cost once your time is priced at $75 an hour. Self-hosting Keycloak here only makes sense for reasons that are not on the invoice: data residency, avoiding a vendor, or wanting to run the thing yourself. Those are real reasons. Saving money is not one of them at this size.
Where to put Keycloak
2.5 GB of memory and 10.1 GB of disk is what this needs at 10 people. The cheapest plan that fits, among the providers whose prices we have read ourselves, is the Starter 4 GB at VPSServer for $22.00 a month.
We are not claiming this is the cheapest server on the internet. It is the cheapest one we can honestly quote. Hetzner Cloud, Vultr and PikaPods publish prices we could not read programmatically, and Hetzner in particular is usually cheaper per gigabyte of memory than anything quoted above. Price them yourself before you commit.
The VPSServer link above is an affiliate link, run through the same programme as our Kamatera link; VPSServer and Kamatera belong to the same group. If you sign up through it we may earn a commission, but the programme does not state an amount for VPSServer. That never changes the computed costs, which server is chosen, or the conclusion of this page. The sizing model and every price source are published in full.
Keycloak at a glance
| Licence | Apache License 2.0 |
|---|---|
| Written in | Java |
| GitHub stars | 36,732, checked 2026-09-12 |
| Latest release | 26.7.3 |
| Last commit | 2026-09-12 |
| Ships Docker images | Yes |
| Project | www.keycloak.org · keycloak/keycloak |
Get the migration checklist for this tool
A one-page pre-flight list: data export path, sizing, backup plan, and the rollback step most people skip.
Every figure on this page, and where it came from
| Input | Value used | Source | Read on |
|---|---|---|---|
| Okta Workforce Identity Starter | USD 6.00 per seat per month, with a minimum of USD 125.00 per month | vendor pricing page | 2026-09-14 |
| VPSServer Starter 4 GB | $22.00 per month | provider pricing page | 2026-09-21 |
| Engineer time | $75 per hour | our published assumption | — |
| Keycloak sizing | 2 GB base, 2 MB per user | project documentation | — |
Prices move. If the vendor has changed theirs since 2026-09-14, the figures above are stale and the source links are the authority, not us. How we handle that.