Borrow, Don't Build · Logins
Keycloak for logins and single sign-on
User accounts, two-factor login and single sign-on with Microsoft or Google, handled by a dedicated, well-tested service instead of hand-written login code.
One place for logins, across all your systems
Keycloak sits in front of your applications and handles everything about who someone is: signing in, two-factor, password resets, and signing in with an account people already have.
It supports the standard protocols, OpenID Connect, OAuth 2.0 and SAML 2.0, so almost any system can use it. It can let people sign in with Microsoft or Google, connect to an existing Active Directory or LDAP directory, and be themed to look like your own brand.
It is open source under the Apache 2.0 licence, one of the most permissive there is, and a Cloud Native Computing Foundation incubation project. Details checked against keycloak.org on 9 October 2026.
What we use it for
Sign in with Microsoft or Google
Staff sign in with the work account they already have, and lose access the moment IT switches it off.
One login for several systems
Your portal, your back office and your reporting share one sign-in, so nobody juggles passwords.
Two-factor login
Authenticator apps or security keys, switched on for everyone or just for administrators.
Customer accounts
Sign-up, email checks, password resets and account pages for your customers, in your own branding.
Connected to your directory
Use the users and groups already in Active Directory or another directory, rather than keeping a second list.
Wired into your software
Your Laravel or PHP application hands sign-in to Keycloak and trusts what comes back, using the standard protocols.
Keycloak runs as its own service. Your application talks to it using standard protocols, and we never change Keycloak itself. More on the approach in borrow, don't build.
Is Keycloak right for you?
A good fit when
- You have more than one system people sign in to
- Staff should sign in with their Microsoft or Google account
- You need two-factor login done properly
- You have customer accounts and want them handled securely
Think twice when
- One small application with one kind of user: the framework's own login is fine
- Microsoft Entra ID already does everything you need
- Nobody can run and update another service
- You only need social login on a single site
The honest summary: for a single small application, the login built into Laravel is enough. Keycloak earns its place once you have several systems, or need single sign-on and two-factor done properly across them.
Keycloak implementation, support and managed Keycloak
What a Keycloak implementation involves
A typical Keycloak implementation: decide how users and roles should be organised, set up the realm, connect each of your applications as a client, add sign-in with Microsoft or Google, switch on two-factor login, theme the login pages in your branding, then test it with real users before switching everyone over. The careful part is moving existing users without forcing everyone to reset their password on day one.
Keycloak support pricing
Keycloak itself is free. Vendor support comes from Red Hat as the Red Hat build of Keycloak, but Red Hat does not sell it on its own: it comes inside bundles such as Red Hat Runtimes, Application Foundations and OpenShift, and you still run it yourself. Checked on Red Hat's customer portal on 11 October 2026. For most smaller businesses, Keycloak support pricing really means paying a developer or a managed provider to look after it.
Managed Keycloak
Several companies offer managed Keycloak, hosting and running it for you and charging by user or by monthly active user. That is a good answer if you want single sign-on without running another server. Prices vary a lot between providers, so compare a few. We can set up your applications against a managed Keycloak just as easily as against one we host.
Do you need a Keycloak consultant?
If you have more than one system to connect, or customer accounts to migrate, a Keycloak consultant saves a lot of trial and error. We are independent developers who wire Keycloak into PHP and Laravel applications, and we will tell you if Microsoft Entra ID or your framework's own login would do the job more simply.
What people ask us
Yes. It is open source under the Apache 2.0 licence. You pay for setting it up, connecting your systems, and hosting it. Some companies sell paid support for it if you want that too.
Yes. Keycloak can hand sign-in to Microsoft, so staff use their work account and you control access in one place.
It is widely used and actively maintained, and it does the hard parts, like password storage and two-factor, in a way that has been looked at by a lot of people. Like any server software, it needs keeping up to date, which we plan for.
If you already run servers and have someone to update them, self-hosting is cheaper. If you do not, a managed Keycloak service takes the hosting and patching off your hands for a monthly fee. Your applications connect the same way either way.
Too many passwords, too many systems?
Tell us who signs in to what.
Which systems people sign in to, whether you use Microsoft 365 or Google Workspace, and whether your customers have accounts. If your framework's own login is enough, we will say so.
We reply within one working day.
