Ory vs Keycloak

Two open-source paths to running identity yourself, with different architectures.

The one-line difference

Ory is a set of API-first, cloud-native open-source components (Kratos, Hydra, Keto, Oathkeeper) plus Ory Network, the managed cloud. Keycloak is a single, mature, all-in-one open-source IAM server backed by Red Hat.

Where Ory wins

• API-first, composable, container-native architecture
• Ory Keto brings Zanzibar-style fine-grained authorization
• Managed Ory Network if you want to offload operations

Where Keycloak wins

• One complete server with an admin console out of the box
• Native SAML, OIDC, and LDAP with a very large community
• Simpler mental model for a single self-hosted deployment

The honest call

If you want composable, API-first identity that fits a cloud-native stack and need fine-grained authorization, Ory fits. If you want a single, batteries-included open-source server with a console and broad protocol support, Keycloak is the default. Both are self-hosted; Ory Network adds a managed option. See the pricing guide and the matcher.