The authorization-first IAM platform.
A complete IAM platform on hardened Keycloak, with Identity Governance and Authorization Governance on top.
From identity to evidence, in one platform.
Identity
- Users & profiles: one console for every account and attribute
- Organizations & multi-tenancy: isolate customers and partners without separate installations
- Delegated administration: tenants manage their own users, inside boundaries you set
- User federation: your LDAP/AD stays the source; nothing migrates
- Custom identity connectors: national ID schemes and legacy IAM, through extension points
Organizations in the Keymate admin console, with a customer organization and its delegated administrators
Works with your identity provider.
Keep what you have: federate over OIDC and SAML, run Keymate in parallel, and cut over when you're ready.
- Microsoft Entra ID
- Okta
- Ping Identity
- AD / LDAP
- Google Workspace
or any OIDC / SAML provider
Free for up to 100 registered users, every module included.
What makes Keymate different
When access is decided at login, it holds until the session ends, even after the right is revoked. Keymate decides per request, so a revoked right stops working now. Authorization →
When each service checks permissions itself, the same if-statements pile up in every codebase. Keymate enforces in the request path: at the Access Gateway with zero code, or through your mesh or SDKs. Enforcement →
When rules live in application code, changing one takes a ticket, a code change and a deploy. In Keymate you change the policy and simulate it. After any approval, it is live the same day. Every version is kept and can be rolled back. Authorization Governance →
Ask who can do what and who approved it, and the answer comes back with the policy version and any approval attached. Nobody rebuilds it from scattered logs before each audit. Evidence →
Keymate federates with it and runs in parallel until you decide to cut over. Architecture →
An agent authenticates, receives policy decisions and leaves evidence like any other identity. Roadmap →
More than 20 million identities migrated, no record lost.
Keymate's migrator moved them from an existing IAM system into Keymate's Keycloak build. A stopped run picked up where it left off, and throughput peaked at 12 million records per hour.
How migration works →What changes when authorization comes first.
| A typical IAM suite | Keymate | |
|---|---|---|
| Authorization model | Roles and groups; every exception becomes another role | Policies: who can do what, when, on which data |
| Enforcement | At sign-in and token issue; some suites add a gateway | In the request path: at the Access Gateway, or through your API gateway, mesh or SDK |
| Changing a rule | Changed in the admin console or API; suite governance products review who holds access | A policy change, versioned, with any approval and rollback |
| Proving compliance | Sign-in and audit logs, plus access-review and certification reports | Every allow and deny, with its policy version and any approval |
Runs on your infrastructure.
Self-hosted end to end: your users, your policies and your evidence never leave your side. The product reports nothing back to us, and Enterprise adds air-gapped deployment.
- Kubernetes
- AWS
- Google Cloud
- Microsoft Azure
on your Kubernetes, wherever it runs
Keycloak
we build it upstream too
22
merged upstream PRs
28
upstream issues opened
5
engineers contributing upstream
From the blog
- New
Common Keycloak Security Mistakes (and How to Avoid Them)
I logged in to a fresh Keycloak 26.8 realm and decoded the access token. Two backend clients would accept it, and checking the audience would not have stopped either one. Here are eight mistakes, most of them defaults, and how to fix them.
What Is IAM? Identity and Access Management Explained
who gets in, what they can touch, and how you prove it later.
Hardening Keycloak for Enterprise Production
zero known OS CVEs at build time, non-root execution, JVM hardening.
Questions
What is Keymate?
Keymate is an authorization-first identity and access management platform that you host yourself. It handles identity, login and fine-grained authorization, enforces access decisions on every request, and keeps a record of every policy change, with any approval behind it. Identity Governance handles joiners, movers and leavers from your HR system; its access reviews are on the roadmap.
What is identity and access management?
Identity and access management (IAM) is the set of systems that decides who a user is, what that user can reach, and how you prove later that each decision was right. It covers accounts, login, access rules and the reviews and evidence around them. For the full picture, read what is identity and access management.
What is the best self-hosted identity and access management platform?
The best self-hosted identity and access management platform is the one that passes four checks for your case: it decides access on every request, enforces each decision in the request path, lets you require an approver and roll a rule change back, and hands your auditor the evidence. No single platform is best for every case, so use these checks when you compare IAM solutions. Our IAM platform comparison sets several identity and access management solutions side by side, including the rows where others are stronger.
Is Keymate open source?
No. Keymate has a free edition under its own license, Community, with every module for up to 100 registered users. Its identity foundation, Keycloak, is open source, and our engineers contribute changes to it upstream; the public record lists each one.
Every module is free for up to 100 registered users.
Two editions: Community (free) and Enterprise (priced per user and per module).