{"data":{"slug":"keycloak","name":"Keycloak","tagline":"Apache-2.0 CNCF-incubation Java IAM: OIDC, OAuth, SAML, LDAP","category":"nextjs","categoryName":"Next.js","url":"https://www.keycloak.org","github":"https://github.com/keycloak/keycloak","pricing":"open-source","hook":"Keycloak is the CNCF IdP the JVM shops already run — not authentik with a different coat.","whatsGood":"Apache-2.0. CNCF incubation. OpenID Connect, OAuth 2.0, SAML 2.0, LDAP user federation, identity brokering. Admin console, realms, clients. Self-host is the product.","theCatch":"CNCF Java IAM, OIDC+OAuth+SAML+LDAP. Distinct from authentik (MIT-core Python, no hosted hatch, enterprise/ carve-out). You run a JVM and a database. There is no $0 Keycloak Cloud on the project site.","verdict":"Apache-2.0 CNCF IdP. Heavy, complete, self-host. Not authentik.","addedAt":"2026-09-03","featured":false,"domain":"Auth","subSpecialty":"Auth","capabilities":["auth","oidc"],"surfaces":["Self-host"],"ecosystem":["Multi-platform"],"licenseModel":"Apache-2.0","githubStars":36590},"related":[{"slug":"vercel","name":"Vercel","tagline":"The platform that made Next.js deployment trivial"},{"slug":"prisma","name":"Prisma","tagline":"Type-safe database access with killer DX"},{"slug":"drizzle","name":"Drizzle ORM","tagline":"TypeScript ORM that feels like SQL"},{"slug":"trpc","name":"tRPC","tagline":"End-to-end typesafe APIs without codegen"},{"slug":"clerk","name":"Clerk","tagline":"Auth that actually ships with your UI"}],"links":{"self":"/api/gems/keycloak","html":"/gems/keycloak","markdown":"/gems/keycloak.md","category":"/api/gems?category=nextjs","categoryPage":"/stacks/nextjs"}}