Keymate pricing

• Community

  Freefor up to 100 registered users

  • Every module: Identity, Authentication, Authorization, Authorization Governance and Identity Governance
  • Self-hosted on your own Kubernetes
  • Install it yourself by following the installation documentation
  • Support through the documentation. Contact-form questions are answered on a best-effort basis
  • Not a trial. Run it in production, with no time limit
  Talk to us

• Enterprise

  Above 100 users, priced per user and per module, on request

  • Every module, for as many users as your agreement covers
  • High availability: two or more replicas of each critical component
  • Air-gapped deployment and OpenShift
  • Support from Keymate's engineers. Your agreement sets the channel, hours and response times
  Talk to us

Who counts: every user created and registered in your production installation, people and service accounts alike, whether or not they sign in. A disabled account counts until it is deleted. Users from a connected directory, such as LDAP or Active Directory, count once their record exists in Keymate. The limit is per installation, not per realm or organization.

Customers and partners: they count toward the 100 like any other registered user, with no separate price. Planning to give them access? Talk to us.

Test and staging: non-production installations are not counted.

Declaring the count: with Enterprise, you declare the user count when you sign the agreement and again at renewal.

Community and Enterprise include the same modules. They differ in the number of users, high availability, deployment options and support.

Identity: who the people and organizations are, and who administers them.

• User management and self-service
• Full admin console and APIs
• Login and admin event logging
• Multi-tenant organizations: each customer or business unit with its own administrators
• User federation: LDAP and Active Directory
• Third-party authentication: social and corporate identity providers

Authentication: how users prove who they are.

• Single sign-on: OpenID Connect, OAuth 2.0 and SAML
• Multi-factor authentication, including passkeys
• Brute-force detection and account lockout
• Session management and token revocation
• Custom login themes and localized flows

Authorization: what each user may do, decided on every request.

• Role-based (RBAC), attribute-based (ABAC) and Keycloak's user-based, client-based and time-based policy rules
• Relationship-based (ReBAC)
• Policy-based (PBAC): policies you can read and version
• Risk-adaptive (RADAC): access that changes with risk signals at request time
• Data-scoped (DSAC): which records inside a resource a user may see
• Keymate Access Gateway: enforcement in the request path, with no code change
• Bring your own decision engine, over open standards

Authorization Governance: who changed each access rule, any approval, and proof of what it decided.

• Optional approval: you can require an approver for each policy change before it goes live
• Version history with rollback
• Decision evidence and reports for auditors
• Decision explainability: the reason behind every deny
• Policy change simulation: test a change against past decisions before it goes live
• Time-bound access: access for a set period, approved together with its end date

Identity Governance: joiner, mover and leaver automation from your HR system, through API-based connectors, is available today and priced per user like the other modules. Access reviews are on the roadmap. See Identity Governance.

Keycloak's license is the Apache License 2.0, so it is free to use at any number of users. Its total cost of ownership is the infrastructure it runs on plus the team time to run, upgrade and patch it. Keymate runs on its own hardened Keycloak build and is self-hosted too, on your own Kubernetes. Its cost is also infrastructure and team time, plus the license. Community is free up to 100 registered users. Enterprise is priced per user and per module and includes support from Keymate's engineers. What Keymate adds to Keycloak, module by module, is on Keymate vs Keycloak.