Compare
Keycloak is the canonical open-source identity and access server — CNCF-backed, battle-tested, and the most widely deployed self-hosted IdP there is. It genuinely beats Qeet ID on maturity, community, and protocol breadth (LDAP/Kerberos, fine-grained Authorization Services). Choose Qeet ID when you want a lightweight Go runtime, a first-party managed cloud, and a more modern developer experience.
Qeet ID
- License
- MIT (open source)
- Self-host
- First-class
- Managed cloud
- EU / US
- Runtime
- Go + Postgres
- SDKs
- React · Node · Go
Keycloak
- License
- Apache-2.0 (OSS)
- Self-host
- First-class (mature)
- Managed cloud
- None (Red Hat sub)
- Runtime
- JVM / Quarkus
- Community
- Very large
The open-source IdP, minus the JVM sprawl.
Keycloak is the battle-tested, CNCF-backed open-source identity server — and it is genuinely more mature at self-hosting than we are. Qeet ID trades some of that maturity for a lighter Go runtime, a first-party managed cloud, and a modern developer experience.
Feature-by-feature
Verified against Qeet ID's implemented status and Keycloak's public docs. Where we're still building, we say so.
- Available
- Partial / gated
- Not offered
| Capability | Qeet ID | Keycloak |
|---|---|---|
| Authentication | ||
Passkeys / WebAuthn | Yes | Yes |
Magic links Keycloak has no native magic-link login; it relies on preview / community authenticators. | Yes | Partial |
Social login (Google, Apple, GitHub, Microsoft, …) | Yes | Yes |
MFA (TOTP, SMS, email, recovery codes) Keycloak ships TOTP + WebAuthn and recovery codes; SMS / email OTP need custom or community authenticators. | Yes | Partial |
| Federation | ||
OAuth 2.0 / OIDC (you are the IdP) | Yes | Yes |
SAML 2.0 SP + IdP | Yes | Yes |
SCIM 2.0 provisioning Keycloak has no native SCIM server; community extensions fill the gap. | Yes | Partial |
LDAP / Kerberos user federation Keycloak federates directly to LDAP/AD and Kerberos out of the box; Qeet ID does not. | No | Yes |
| Authorization | ||
RBAC + single-call /check API Keycloak exposes roles/groups; Qeet ID adds a single-call /check endpoint. | Yes | Yes |
Fine-grained / ReBAC authorization Keycloak's Authorization Services (UMA 2.0) ship resource-level fine-grained permissions today; Qeet ID's ReBAC is planned. | Roadmap | Yes |
Explainable authz (grant-path “why?” trace) Qeet ID returns the grant path or denial reason on every check. | Yes | No |
| Deployment | ||
Open-source core Both are permissively licensed open source. | MIT | Apache-2.0 |
Self-host first-class Keycloak is the canonical self-hosted IdP and fully mature; Qeet ID ships a single lightweight Go binary vs Keycloak's JVM / Quarkus footprint. | Yes | Yes |
First-party managed cloud (SaaS) The Keycloak project offers no hosted SaaS; the managed 'Red Hat build of Keycloak' needs a Red Hat subscription. | Yes | No |
| Pricing | ||
Self-host cost | Free (MIT) | Free (Apache-2.0) |
Managed cloud free tier | 25,000 MAU | No SaaS |
| Security & audit | ||
Tamper-evident hash-chained audit log + /verify Keycloak logs admin/login events, but they are not hash-chained or independently verifiable. | Yes | Partial |
Breached-password rejection (HIBP) Keycloak enforces password policies but has no built-in HIBP breach check. | Yes | No |
Refresh-token theft detection Keycloak supports refresh-token rotation / revocation; Qeet ID adds automatic reuse-detection. | Yes | Partial |
| Compliance | ||
GDPR erasure / data export | Yes | Yes |
Managed-cloud SOC 2 Type II / ISO 27001 Keycloak has no first-party cloud to certify; certification is on you when you self-host either project. | Roadmap (pre-GA) | No SaaS |
| Developer experience | ||
Webhook events (HMAC + retries) Keycloak has no native outbound webhooks; you build an event-listener SPI (or use community webhook extensions). | Yes | Partial |
First-party typed SDKs Keycloak ships keycloak-js + adapters; typed clients for other languages are largely community-maintained. | React · Node · Go | Partial |
Native admin dashboard Keycloak's admin console is mature but JVM-heavy with a dated UX. | Yes | Yes |
Comparison is based on publicly-available product information at the time of writing. We do our best to be accurate — if anything above is wrong, please let us know and we'll correct it.
Migrate from Keycloak
Prefer a lighter IdP with a managed option?
Run Qeet ID as a single Go binary on your own infrastructure, or start free on our hosted cloud. If Keycloak already fits your stack, honestly — keep it.