Compare

FoxAuth compared with Keycloak

Both are servers you run yourself. They differ in runtime, storage, scope and how much of the protocol is on by default.

Last checked 2026-09-03 against the linked sources. Keycloak changes; where its documentation did not say, this page says so rather than guessing. Found something out of date? Tell us at hello@foxauth.dev.

The short answer

Pick Keycloak if you need SAML, LDAP federation or certified FAPI today. Pick FoxAuth if your team writes TypeScript, wants OAuth 2.1 behaviour as the default, or wants an AI agent administering the server through the same audited path a human uses.

Choose Keycloak if…

You need SAML as well as OpenID Connect.
You want LDAP or Active Directory user federation, realms, or policy-based fine-grained authorization.
You already run the JVM and a relational database, and a compliance reviewer recognises the name.
You need extensive FAPI documentation and profiles (Open Finance Brasil, Australian CDR) today.

Choose FoxAuth if…

Your team writes TypeScript and would rather read the server than wrap it.
You want PKCE for every client, exact redirect matching and no Implicit grant as the default, not per-client configuration.
You want an AI agent to administer the instance through the console's own permission checks and audit trail.
You run MongoDB, or you want a server small enough to mount inside your own Bun service.

Side by side

Every row has a verdict and the reason for it

●: Built in
◐: Behind a flag, preview or add-on
○: Not available
?: Not documented
—: Not applicable

Row verdicts: 3 FoxAuth ·5Keycloak · 7 even ·1 different goals. A count is not a recommendation — the rows that matter to you are the ones that count.

Dimension	FoxAuth	Keycloak	Verdict
Getting started and operations
Hosting model	●Self-hosted container, or imported as a library into your own Bun service.	●Self-hosted container; start-dev mode for a first look.	Even Both run where you put them.
Runtime and stack	●TypeScript on Bun; the HTTP layer is Elysia.	●Java on Quarkus.	Different goals Pick the one your team can read and debug at 2 a.m. What their docs say The docs state that "Keycloak uses the Quarkus framework and a re-augmentation/mutable-jar approach under the covers".
Storage	●MongoDB in production, in-memory for tests, one adapter interface.	●PostgreSQL, MySQL, MariaDB, Oracle, SQL Server, Aurora, Azure SQL.	Keycloak Keycloak speaks the relational databases most teams already operate. What their docs say dev-file and dev-mem are "not suitable for production use-cases".
Scope beyond OAuth and OIDC	○OAuth 2.1, OpenID Connect and upstream OIDC federation. No SAML, no LDAP.	●SAML, LDAP and Kerberos federation, realms, fine-grained authorization services.	Keycloak If SAML or LDAP is on your list, this is not a close call.
Maturity	◐0.1.0, the first tagged release (September 2026). No production track record to point at yet.	●Long-established, large ecosystem of adapters and themes.	Keycloak Years of production use count.
Protocol coverage
PKCE for every client (OAuth 2.1)	●Mandatory for every client, public or confidential. No Implicit or password grant.	◐Supported; S256 enforced under the FAPI profiles. A server-wide default is not documented.	FoxAuth OAuth 2.1 behaviour is the default, not something you configure per client. What their docs say Referenced as "RFC 7637 Proof Key for Code Exchange (PKCE)" (their numbering; the RFC is 7636).
DPoP (RFC 9449)	◐Including server nonces, behind dpop.enabled.	◐Documented as a preview feature.	FoxAuth Shipped rather than previewed; both need switching on. What their docs say Described as "a preview feature" that "binds an access token and a refresh token together with the public part of a client's key pair".
Pushed Authorization Requests (RFC 9126)	◐Behind par.enabled.	●Supported, documented alongside the FAPI client profiles.	Even Both implement it.
FAPI profiles	◐Profile behaviours behind fapi.enabled. No conformance certification.	●FAPI 1 Baseline and Advanced, FAPI CIBA, FAPI 2.0 Security Profile and Message Signing, Open Finance Brasil, Australian CDR.	Keycloak Keycloak's FAPI coverage and documentation are far ahead of ours.
CIBA	◐Behind ciba.enabled.	●Supported.	Even Both implement it.
mTLS (RFC 8705)	◐Client authentication and certificate-bound tokens, behind mTLS.enabled.	●Certificate-bound access tokens, documented in the FAPI material.	Even Both implement it.
Dynamic client registration	◐RFC 7591, plus RFC 7592 management, each behind its own flag.	●Supported.	Even Both implement it.
Administration and agents
Admin console	●Projects, clients, administrators, user buckets, end-users, upstream providers, settings, SMTP, signing keys.	●Admin Console for realms and most administrative tasks.	Even Both have one; Keycloak's covers a broader product.
Administration by an AI agent (MCP)	◐60 MCP tools served by the server itself, two-call confirmation for destructive operations, behind mcp.enabled.	?No MCP guide in the documentation index; administration is the Admin REST API.	FoxAuth An agent runs the console's own code path, checks and audit trail; there is no second privileged API to keep in step.
Licence and cost
Licence	●FSL-1.1-ALv2, source-available; each release becomes Apache 2.0 after two years.	●Apache License 2.0.	Keycloak Apache 2.0 today is the more permissive licence.
Cost	●Free to self-host, every feature included. Support by agreement.	●Free. No pricing is published on keycloak.org.	Even Both cost what running them costs.

Migrating

There is no importer. Clients are re-registered through the admin API or dynamic registration, and end-user records are created per user bucket. Password hashes are not portable between the two, so plan a reset-on-first-login window or run both servers during a cut-over.

Sources

What we read

Try it yourself All features