Skip to content
FoxAuth

Compare

FoxAuth compared with Keycloak

Both are servers you can run yourself, and FoxAuth also has a free cloud plan. They differ in runtime, storage, scope and protocol defaults.

Last checked 2026-10-16 against the linked sources. Keycloak changes. Where its documentation did not say, this page says so instead of guessing. Found something out of date? Tell us at hello@foxauth.dev.

The short answer

Pick Keycloak if you need SAML, LDAP federation or certified FAPI today. FoxAuth is the better fit for a team that writes TypeScript, wants OAuth 2.1 behaviour as the default, or wants an AI agent administering the server through the same audited path a human uses.

Choose Keycloak if…

  • You need SAML as well as OpenID Connect.
  • You want LDAP or Active Directory user federation, per-realm authentication flows, or policy-based fine-grained authorization.
  • You already run the JVM and a relational database, and a compliance reviewer will probably recognise the name.
  • You need extensive FAPI documentation and profiles (Open Finance Brasil, Australian CDR) today.

Choose FoxAuth if…

  • Your team writes TypeScript and would rather read the server than wrap it.
  • You want PKCE for every client, exact redirect matching and no Implicit grant to be the default, with nothing to configure per client.
  • You want an AI agent to administer the instance through the console's own permission checks and audit trail.
  • You want a server small enough to mount inside your own Bun service, on the PostgreSQL or MongoDB you already run.

Side by side

Every row has a verdict and the reason for it

Built in
Behind a flag, preview or add-on
Not available
Not documented
Not applicable

Row verdicts: 4 FoxAuth ·5Keycloak · 8 even ·2 different goals. A count is not a recommendation. The rows that matter to you are the ones that count.

DimensionFoxAuthKeycloakVerdict
Getting started and operations
Hosting model●Self-hosted container, imported as a library into your own Bun service, or a free plan on FoxAuth Cloud with limits and no SLA yet.●Self-hosted container; start-dev mode for a first look.Even

Both run where you put them. FoxAuth can also be used without running anything.

Runtime and stack●TypeScript on Bun; the HTTP layer is Elysia.●Java on Quarkus.Different goals

Pick the one your team can read and debug at 2 a.m.

What their docs say

The docs state that "Keycloak uses the Quarkus framework and a re-augmentation/mutable-jar approach under the covers".

Storage●PostgreSQL or MongoDB in production, in-memory for tests, one adapter interface.●PostgreSQL, MySQL, MariaDB, Oracle, SQL Server, Aurora, Azure SQL.Keycloak

Both speak PostgreSQL; Keycloak also speaks six other relational databases, which matters if yours is one of them.

What their docs say

dev-file and dev-mem are "not suitable for production use-cases".

Scope beyond OAuth and OIDC○OAuth 2.1, OpenID Connect, and sign-in through Google, Microsoft, Apple, GitHub or any other OIDC provider; SCIM 2.0 provisioning from a directory, behind scim.enabled. No SAML, no LDAP.●SAML, LDAP and Kerberos federation, realms, fine-grained authorization services.Keycloak

If SAML or LDAP is on your list, this is unlikely to be a close call.

Multi-tenancy●Projects, each its own issuer with its own signing keys. A project takes a path beneath the server's URL, a subdomain of the instance or a hostname of its own, counts its own monthly active users, moves between administrator teams with its applications and APIs, and can be restored for 30 days after it is deleted.●Realms, each its own issuer at /realms/name, carrying their own flows, mappers and signing keys.Different goals

Both sign with keys of their own, but a realm carries far more than a project does — its own authentication flows and mappers — and if you need that, it is not close. A project can take a hostname of its own, which a realm cannot: Keycloak's hostname is a server-wide setting, so host-per-tenant is built in front of it rather than configured in it.

What their docs say

Keycloak's hostname configuration is documented at the server level, not per realm.

Maturity◐1.1.0 (October 2026). No production track record to point at yet.●Long-established, large ecosystem of adapters and themes.Keycloak

Years of production use count.

Protocol coverage
PKCE for every client (OAuth 2.1)●Mandatory for every client, public or confidential. No Implicit or password grant.◐Supported; S256 enforced under the FAPI profiles. A server-wide default is not documented.FoxAuth

OAuth 2.1 behaviour is the default; there is nothing to configure per client.

What their docs say

Referenced as "RFC 7637 Proof Key for Code Exchange (PKCE)" (their numbering; the RFC is 7636).

DPoP (RFC 9449)◐Including server nonces, behind dpop.enabled.◐Documented as a preview feature.FoxAuth

Ours is shipped and theirs is previewed; both need switching on.

What their docs say

Described as "a preview feature" that "binds an access token and a refresh token together with the public part of a client's key pair".

Pushed Authorization Requests (RFC 9126)◐Behind par.enabled.●Supported, documented alongside the FAPI client profiles.Even

Both implement it.

FAPI profiles◐Profile behaviours behind fapi.enabled. No conformance certification.●FAPI 1 Baseline and Advanced, FAPI CIBA, FAPI 2.0 Security Profile and Message Signing, Open Finance Brasil, Australian CDR.Keycloak

Keycloak's FAPI coverage and documentation are far ahead of ours.

CIBA◐Behind ciba.enabled.●Supported.Even

Both implement it.

mTLS (RFC 8705)◐Client authentication and certificate-bound tokens, behind mTLS.enabled.●Certificate-bound access tokens, documented in the FAPI material.Even

Both implement it.

Dynamic client registration◐RFC 7591, plus RFC 7592 management, each behind its own flag. Deprecated by the MCP specification in favour of client identity documents.●Supported.Even

Both implement it.

Client identity documents (CIMD)◐A client_id that is an HTTPS URL naming a document describing the client, retrieved and validated on demand, stored nowhere. Behind clientIdMetadataDocument.enabled.◐Supported since 26.6, and documented as experimental: "may introduce breaking changes in future versions".Even

Both implement the mechanism the MCP specification names first; theirs is labelled experimental and ours is behind a flag.

Authorization for your MCP server●Declare the MCP server as a protected resource of a project and tokens carry it as their sole audience, via the resource parameter (RFC 8707). No code change, no restart.◐Documented as an MCP authorization server, but "Keycloak cannot recognize resource parameter". Audience binding is done instead with a client scope and an audience mapper per MCP server.FoxAuth

Both can front an MCP server. The difference is how the token is bound to it: the resource parameter the MCP specification requires of clients, against a per-server scope and mapper configured by hand.

What their docs say

Keycloak states full support for MCP 2025-03-26 and partial support for later revisions, and that RFC 9728 metadata is the MCP server’s job rather than the authorization server’s — the same position taken here.

Administration and agents
Admin console●Projects with their applications and APIs, administrators and their teams, end-users, upstream providers, SCIM connections, usage, settings, SMTP, signing keys. Administrators can sign in through your own identity provider, and a change that could lock people out is previewed with counts before it applies.●Admin Console for realms and most administrative tasks.Even

Both have one; Keycloak's covers a broader product.

Administration by an AI agent (MCP)◐Every console operation as an MCP tool, bar a few withheld on purpose, served by the server itself, two-call confirmation for destructive operations, behind mcp.enabled.○Administration is the Admin REST API. Keycloak documents MCP as an authorization server for other people’s MCP servers, and does not describe it as an interface for administering Keycloak.FoxAuth

An agent runs the console's own code path, checks and audit trail; there is no second privileged API to keep in step.

What their docs say

Keycloak’s MCP page is about a different job — being the authorization server in front of an MCP server. That capability is compared separately below.

Licence and cost
Licence●FSL-1.1-ALv2, source-available; each release becomes Apache 2.0 after two years.●Apache License 2.0.Keycloak

Apache 2.0 today is the more permissive licence.

Cost●Free to self-host, every feature included and no limits. FoxAuth Cloud has a free plan with limits; paid cloud plans are in development. Support by agreement.●Free. No pricing is published on keycloak.org.Even

Both cost what running them costs.

Migrating

There is no importer. Clients are re-registered through the admin API or dynamic registration, and end-user records are created per project. Password hashes are not portable between the two, so plan a reset-on-first-login window or run both servers during a cut-over.

Questions

What people ask before they switch

Can I migrate from Keycloak to FoxAuth?

Clients and users usually move from Keycloak to FoxAuth without much trouble. Both are OpenID Connect servers, so a client written against Keycloak's token endpoint works against FoxAuth's once the issuer and the client id change. A Keycloak realm maps onto a FoxAuth project more directly than the names suggest: a project is its own issuer, so `https://auth.example.com/acme` publishes its own metadata and mints tokens carrying itself as `iss`, exactly as `/realms/acme` does. A project can also take a subdomain of the instance or a hostname of its own — `https://acme.auth.example.com` — which Keycloak realms cannot; there the hostname is a server-wide setting, so host-per-tenant is something you build in front of Keycloak rather than configure in it. A project with an address also signs with keys of its own and publishes them at its own `jwks_uri`, as a realm does. What does not map is the rest of what a realm carries — authentication flows and mappers — and custom behaviour lives in 31 named override seams in TypeScript where Keycloak would have you write SPI implementations in Java.

Is FoxAuth lighter to run than Keycloak?

FoxAuth is a Bun process and one database, PostgreSQL or MongoDB, which is a smaller operational surface than a JVM application server and its relational schema. It starts in under a second, against tens of seconds for Keycloak. That is a real difference in memory and startup. It is no difference at all in what the protocol endpoints do. Keycloak has years more production hardening behind it, and that is worth weighing against a server whose first stable release, 1.0.0, shipped in October 2026.

Does FoxAuth support SAML?

FoxAuth does not support SAML, and none is planned. For sign-in it implements OAuth 2.1 and OpenID Connect only; it also accepts SCIM 2.0 provisioning from a directory, which does not sign anyone in. If an application in your estate can only speak SAML, FoxAuth cannot serve it and Keycloak can, which is a good reason to stay where you are.

Can an AI agent administer FoxAuth?

An AI agent can administer FoxAuth over MCP, and it uses the same code path a human administrator uses; there is no separate privileged API. Every agent action runs through the console's own routes, permission checks and validation, and lands in the append-only audit trail attributed to the agent. Destructive operations require a second confirming call. The whole surface is off until you set mcp.enabled.

Sources

What we read

Try it yourselfAll features