Self-hosted identity and SSO
Five open-source identity servers can stand in for Okta or Auth0 on a VPS you own. Run authentik if you need SAML, LDAP and RADIUS behind an admin UI. Run Keycloak if you want an Apache-2.0 CNCF project. Run Pocket ID if passkey-only OIDC is enough. Any of them fits on one 4 GB box.
Every number below was checked on 9 September 2026 against the vendor's own pricing page, the project's own docs, or the GitHub API. Where a figure could not be confirmed at that level, it is not on the page.
Which self-hosted identity server should you run?
| Server | Protocols it speaks | Stack | Licence | Stars | Run it when |
|---|---|---|---|---|---|
| authentik | OIDC, SAML, LDAP, SCIM, RADIUS, Kerberos, forward-auth proxy | Python + PostgreSQL | MIT for the core, a separate licence for authentik/enterprise/ | 25,415 | You are putting a rack of self-hosted apps behind one login and want a UI for the flows |
| Keycloak | OpenID Connect, OAuth 2.0, SAML; LDAP and Active Directory federation | Java (Quarkus) + relational database | Apache-2.0 | 36,684 | You want a foundation-governed project with a long enterprise track record |
| Zitadel | OIDC and OAuth 2.0 | Go + PostgreSQL | AGPL-3.0 | 14,971 | You want a Go service on Postgres and AGPL-3.0 is acceptable to your legal team |
| Ory Hydra + Kratos | OAuth 2.1 / OIDC in Hydra, identity and login flows in Kratos | Go + relational database | Apache-2.0 | 17,527 and 13,872 | You are building the login screens yourself and want headless APIs, not an admin console |
| Pocket ID | OIDC only, and passkeys are the only login method | Single Go binary + SQLite, PostgreSQL optional | BSD-2-Clause | 9,138 | One person or one small team, no SAML, no LDAP, no password reset flow to run |
Star counts and licences were read from the GitHub API on 9 September 2026. Protocol lists come from each project's own site: goauthentik.io, keycloak.org, pocket-id.org, and the Ory and Zitadel repositories.
Two of these are not really alternatives to the other three. Ory is a set of headless APIs; you get no login UI and no admin console, so budget frontend work. Pocket ID has no SAML and no LDAP, which rules it out for most workforce SSO the moment someone asks for an Active Directory sync.
What does self-hosting actually save you?
| Option | Price | What that price buys |
|---|---|---|
| Any of the five, self-hosted | $72/mo subject to change · verified 2026-09-09 | Liquid Web 4 GB Managed VPS, 2 vCPU, 80 GB SSD. $36/mo for the first two months. |
| Okta Workforce Identity Starter | $6 per user per month, billed annually | SSO, MFA and Universal Directory, with a $1,500 annual contract minimum |
| Auth0, free tier | $0 | Up to 25,000 monthly active users |
| Auth0 Essentials, 500 MAU | $35/mo B2C, $150/mo B2B | Yearly billing is 11x the monthly price |
| Auth0 Professional, 500 MAU | $240/mo B2C, $800/mo B2B | Same 500 MAU, higher feature tier |
| authentik Enterprise | $5 per user per month, billed annually | Support, privileged access management, mTLS. On top of your own hosting bill. |
Okta and Auth0 figures verified at okta.com/pricing and auth0.com/pricing on 9 September 2026. Hosting verified at liquidweb.com the same day.
Okta's $1,500 annual minimum decides most of these comparisons. At $6 per user per month billed annually, $1,500 covers roughly 21 seats, so a ten-person company and a twenty-person company pay the same $1,500 — about $125 a month for the ten-person one. A 4 GB VPS at $72 a month is $864 a year. Below roughly 21 employees you save about $636 a year by self-hosting, and above that the gap widens with every seat you add.
When is Okta or Auth0 still the better call?
Auth0's free tier covers 25,000 monthly active users. If you are authenticating end users into a consumer app and you sit under that ceiling, self-hosting does not save you money. It costs you $864 a year and a patching schedule to replace something that is currently free. The arithmetic only flips when you cross into a paid tier, or when you need something the free plan does not give you.
The B2B track is where it flips soonest. Auth0 Essentials for B2B at 500 monthly active users is $150 a month, or $1,800 a year, against $864 for the VPS. That is a real saving, and it is also the point where you take on the uptime.
Okta and Auth0 sell a support queue and a contractual uptime commitment. None of the five projects below the line do. If the identity server going down means nobody in the company can log in to anything — the wiki, the CRM, the deployment dashboard — that difference is worth more than the invoice gap for a lot of teams, and it does not appear anywhere in the VPS line.
What changed in these projects recently?
Most write-ups of self-hosted SSO are a rewrite of the vendor's landing page. Here is what has actually moved, with dates.
- authentik 2025.10 removed Redis completely. Caching, background tasks, the embedded proxy outpost's session store and WebSocket connections all moved into PostgreSQL. authentik's own release notes say to expect roughly 50% more database connections as a result, and that a Postgres instance requiring TLS now needs TLS 1.3 or the Extended Master Secret extension. Any compose file you copy from an older tutorial still has a Redis container in it that does nothing.
- authentik ships calendar-versioned releases roughly monthly. 2026.8.1 was published on 1 September 2026. A pinned tag in any guide, including ours, is stale within weeks. Check the releases page before you pin.
- Keycloak has been a CNCF incubating project since 10 April 2023. It came out of Red Hat and JBoss, and that heritage is real, but "Red Hat product" is no longer the right mental model for how it is governed.
- Keycloak publishes a memory figure that is easy to misread. Its sizing guide puts base memory for a pod at 1,250 MB with realm caches and 10,000 cached sessions, plus about 300 MB of non-heap memory. That is a loaded pod, not an idle one. Do not compare it against an idle-RAM number you found in a blog post; they are measuring different things.
What breaks when you self-host SSO?
- Everything behind it goes down with it. An identity server is not one more app on the box. It is the thing every other app calls before it will show anyone a page. Test what happens when it is unreachable, before you find out in production.
- Upgrades stop being optional. A CVE in your wiki is a bad week. A CVE in the thing holding your session tokens is a different category. authentik's monthly cadence means you are reading release notes every month or you are behind.
- Backups have to cover the database. Snapshotting the Docker volume is not enough for the four servers that keep state in PostgreSQL. Pocket ID is the exception: its default database is a single SQLite file at
data/pocket-id.db, which is genuinely easy to copy. - Password reset needs working outbound mail. Every one of these except Pocket ID, which has no passwords at all, will eventually need SMTP that survives a spam filter. Budget for a relay.
- You can lock yourself out. Set up a break-glass local admin and write down how to use it somewhere that is not behind the SSO server.
None of these are reasons not to self-host. They are the work you are taking on in exchange for the $636 to $936 a year.
How much VPS does an identity server need?
authentik's install docs ask for a host with at least 2 CPU cores and 2 GB of RAM. That is the floor for authentik on its own, and the whole point of running an identity server is that other applications sit behind it, so size for those too. The 4 GB tier is the sensible starting point for authentik or Keycloak with a couple of apps; Pocket ID will happily share a 2 GB box with something else.
If the identity server is the only thing you will ever put on the machine, a cheap self-managed VPS runs it fine and managed hosting is money you do not need to spend. Managed becomes worth paying for once the same box also runs the applications that break when auth breaks — a PaaS like Coolify, a helpdesk, a CRM. The same arithmetic applies to the rest of the catalogue in the self-hosted versus SaaS cost comparison.
authentik, if you need SAML or LDAP. It ships an admin UI and a visual flow editor, speaks OIDC, SAML, LDAP, SCIM, RADIUS and Kerberos, and runs on Docker Compose with PostgreSQL. If you only need OIDC and everyone can use passkeys, Pocket ID is far less to operate: one Go binary and a SQLite file.
Not always. Auth0's free tier covers 25,000 monthly active users, so a consumer app under that ceiling pays nothing and a $72/mo VPS is a straight loss. Against Auth0 Essentials for B2B at 500 MAU ($150/mo, verified 9 September 2026), self-hosting on a $72/mo VPS saves about $936 a year, before your own time.
No. Release 2025.10 removed Redis entirely and moved caching, tasks, the proxy outpost's session store and WebSockets into PostgreSQL. authentik's release notes warn to expect roughly 50% more Postgres connections afterwards. Compose files written before October 2025 still start a Redis container that authentik no longer uses.
Keycloak originated at Red Hat and JBoss, but it was accepted into the Cloud Native Computing Foundation on 10 April 2023 at the Incubating maturity level. The upstream project is Apache-2.0 licensed and governed under the CNCF, so 'Red Hat product' is no longer the right way to think about who steers it.