Keycloak hosting Single sign-on that never boots open.
Keycloak hosting on Selfhost.dev runs Keycloak in production mode with its own PostgreSQL on a dedicated server we provision, secure and run. Your admin login is set before the first boot and HTTPS is on from the start, so your apps get OAuth 2.0, OpenID Connect and SAML from one place.
Production mode from the first boot, with the admin already in place, so the admin console is never open to whoever finds it first.
- Keycloak26.8.1, production mode
- databasePostgreSQL 16, bundled
- adminyours, before the first boot
- Java heapcapped at 1 GB
- HTTPSon from the start
What is Keycloak hosting?
What it is
Keycloak is open source identity and access management: single sign-on for your apps and users over OAuth 2.0, OpenID Connect and SAML. Keycloak hosting runs it, with its database, where every app you connect can always reach it.
Who it is for
Teams that want one sign-in across their own apps and tools, run on a server they control.
When to use it
When you want Keycloak running in production mode with a real database without setting up Docker, PostgreSQL, TLS and the hostname by hand.
Keycloak Docker in production mode, set up for you
The template runs Keycloak in production mode behind our TLS proxy, with its own PostgreSQL and its hostname taken from your address. These are the settings it writes before the first boot.
The stack, end to end
Your apps and their users
TLS and routing
Keycloak 26.8.1
PostgreSQL 16
Your admin login
| What the template sets | Why |
|---|---|
quay.io/keycloak/keycloak:26.8.1, an exact tag | Keycloak changes only when we re-pin it, never on a restart |
start, never start-dev | Production mode from the first boot |
KC_BOOTSTRAP_ADMIN_USERNAME and KC_BOOTSTRAP_ADMIN_PASSWORD from your login | The admin exists before Keycloak first answers; had that step failed, Keycloak would boot locked with a random password, never open |
KC_HOSTNAME from your address | Issuer, login and redirect URLs use your HTTPS address and follow a custom domain |
KC_PROXY_HEADERS=xforwarded | Keycloak trusts the TLS proxy in front of it |
| PostgreSQL 16 beside it | Realms, clients and users are kept in a real database |
| A Java heap of 256 MB to 1 GB | Keycloak does not size itself from the whole server |
Keycloak hosting requirements
Keycloak hosting requirements come from Java. The platform weighs Keycloak as a heavy app and will not place it on a server under 2 GB; this template starts on 4 GB, with the heap capped at 1 GB so Keycloak does not claim most of the server for itself.
What it needs
- Keycloak
- 26.8.1, pinned, one node
- Database
- PostgreSQL 16, on the same server
- Memory and CPU
- 4 GB by default, 2 GB at least; x86 or ARM
- Java heap
- 256 MB to 1 GB
- Admin login
- A password of at least 8 characters; the name is admin unless you choose another
- First boot
- Builds the server and runs the schema migrations; the console allows up to fifteen minutes
How to deploy Keycloak in 3 steps
One admin login, one click, then your first realm.
-
Choose Keycloak and a 4 GB server
Launch opens the Keycloak template in the console. Set an admin password of at least eight characters; the admin name is admin unless you choose another.
-
Launch it
The first boot builds the server and runs its database migrations, so it takes a few minutes; the console allows up to fifteen. Then Open Keycloak lands on the admin console.
-
Add your domain, then a realm
If you want your own domain, add it now, before any app depends on the address. Then create a realm for your apps and add clients and users.
What Keycloak hosting costs
Keycloak hosting here is one server line. Keycloak is free under the Apache 2.0 licence, the template adds no fee and users cost nothing extra. A European 4 GB server is $0.02/hr, about $15 to $16 a month, paid by the hour from prepaid credits.
| Item | Cost |
|---|---|
| Keycloak and its PostgreSQL | $0 |
| Realms, clients and users | $0, limited only by the server size |
| Bandwidth | $0, traffic is included in the server price |
| Optional daily backups | +20% of the server price |
| Server | RAM, cores, disk | Where | Rate | About a month |
|---|---|---|---|---|
cx23 (recommended) | 4 GB, 2 cores, 40 GB | Europe | $0.02/hr | $15.18 |
cax11 (ARM) | 4 GB, 2 cores, 40 GB | Europe | $0.02/hr | $16.35 |
cpx21 | 4 GB, 3 cores, 80 GB | US | $0.12/hr | $87.75 |
cpx22 | 4 GB, 2 cores, 80 GB | Singapore | $0.10/hr | $72.56 |
cx33 (busier realms) | 8 GB, 4 cores, 80 GB | Europe | $0.03/hr | $23.36 |
Monthly figures assume 730 hours.
If your balance reaches zero
With a card on file or a past top-up, Keycloak keeps running for 5 days after your balance reaches zero. Then it is stopped and kept for 24 hours before it is deleted; a top-up in that time restarts it. We email you when the balance reaches zero and again when it stops. Welcome-credit-only servers are deleted at zero.
Price another size or region in the calculator, no signup.
What we run and what you configure
Keycloak, its database and HTTPS are ours to run. What Keycloak protects, and for whom, is set up by you inside Keycloak.
On the server (we set it up)
- Keycloak, PostgreSQL and HTTPS
- Your admin login, set before the first boot
- The address your issuer URLs are built from
What you configure
- Realms for your apps
- Clients and users inside Keycloak
- A custom domain, added before you connect apps
Five checks on every Keycloak server
- Never open on the internet. Your admin is set before Keycloak first starts; if that step ever failed, Keycloak would boot locked with a random password instead.
- A deploy is never reported done until Keycloak is ready. The health check passes only when Keycloak answers 200, not while its first boot is still migrating.
- Your Keycloak version stays put. The image is an exact tag; a restart or redeploy brings back the same build.
- The heap is bounded. Keycloak cannot claim most of the server's memory for itself.
- A warning before your address moves. The console warns before it applies a custom domain, because the apps you connected must follow it.
The console allows up to fifteen minutes for the Keycloak template after the server is ready, because its first boot builds the server and migrates the database; first-time server provisioning adds time.
Keycloak hosting limitations
- Set your domain first. Keycloak builds its issuer, login and redirect URLs from its address. Adding a custom domain later redeploys it, Keycloak then answers only there, and every app you connected must be pointed at the new address.
- Change the admin password inside Keycloak. The password in the console is read only on the first boot; changing it there later does nothing.
- One node, not a cluster. There is no second Keycloak to fail over to; nothing is replicated beyond the optional daily backups.
- Upgrades are not one click yet. When a newer release ships, the console shows Update available, but upgrades from the console are not switched on for Keycloak.
Nothing here in your way? Add your domain first, then connect your apps.
Launch KeycloakKeycloak backup and restore
Keycloak keeps its realms, clients and users in the bundled PostgreSQL, in a volume on the server beside a small data volume of its own. The server can take an optional daily image of both; to copy them out, ask us for container access over SSH.
| Method | What it covers | Where it lives |
|---|---|---|
| Daily server backup (optional, +20%) | Keycloak and its PostgreSQL volume; the last 7 kept | With the server; deleted with it |
| A copy of the volumes | The PostgreSQL data and Keycloak's data folder | Your storage, via container access over SSH, granted on request |
Not sure 4 GB holds your users?
Tell us how many apps and users will sign in through Keycloak. We send back the size we would pick and what it costs a month.
Frequently asked questions
Is Keycloak free?
Yes. Keycloak is open source under the Apache 2.0 licence. Here you pay only for the server it runs on, by the hour from prepaid credits; the template adds no fee and users cost nothing extra. See pricing.
What is the Keycloak admin login?
The one you set in the console at deploy time: the name is admin unless you choose another, with your password of at least eight characters. Keycloak creates it as the master realm admin on the first boot. It calls this account a temporary admin and suggests creating a permanent one; this one keeps working either way. To change its password later, change it inside Keycloak.
Can I use my own domain for Keycloak?
Yes, and add it before you connect apps. Point the domain's DNS at the server, then add it from the project in the console. Keycloak redeploys and from then on answers only on the new domain, so any app already using the old address must be given the new issuer, discovery URL and redirect URIs. The console warns you before it applies the domain.
How much memory does Keycloak need?
This template starts on 4 GB. The platform weighs Keycloak as a heavy app and will not place it on a server under 2 GB. Its Java heap is capped at 1 GB, so Keycloak does not size itself from the whole server.
Does Keycloak run as a cluster here?
No. The template runs one Keycloak node with its own PostgreSQL on one server. There is no second node to fail over to; the optional daily backups are the copy.
Related guides.
Single sign-on on your own server. Locked from the first boot.
- Keycloak in production mode with its own PostgreSQL
- Your admin login before the first boot
- A European 4 GB server, about $15 to $16 a month
About Selfhost.dev
Selfhost.dev is a managed self hosting platform for developers and small teams. Open source apps and databases on dedicated servers you control, billed by the hour, in six locations across three continents.
Best for: Keycloak, GitLab, Grafana, Vaultwarden and managed PostgreSQL, MySQL, Redis, ClickHouse, OpenSearch and Kafka.