Logto vs Ory vs Keycloak: Open Source Identity Providers 2026
TL;DR
Choose Logto when you want one modern application-IAM product with hosted and self-hosted paths. Choose Ory when a headless architecture and separate services for identity and OAuth fit your team’s system design. Choose Keycloak when you want a self-hosted identity server with established administration surfaces and you are prepared to operate it. The products overlap, but their deployment models, service boundaries, licenses, and cloud pricing are not comparable as one simple scorecard.
Key Takeaways
- Start with architecture: integrated application IAM, headless identity services, or a self-hosted identity server.
- Validate OIDC/OAuth flows, organizations, roles, account recovery, and administration against current vendor documentation.
- Treat plan limits as vendor-specific. A cloud entitlement and self-hosted capacity are different measurements.
- Run a real migration test with representative users, sessions, claims, and recovery flows before committing.
- Use repository and release records as dated maintenance context, not as a proxy for product quality or adoption.
At-a-glance
| Decision area | Logto | Ory | Keycloak |
|---|---|---|---|
| Product shape | Application IAM with authentication and authorization | Headless platform built from distinct identity and OAuth services | Self-hosted identity and access-management server |
| Operating choice | Cloud or self-hosted | Cloud or self-hosted services | Self-hosted project surface in this comparison |
| Integration posture | Application-oriented SDK and protocol integration | API-first flows and service composition | Server configuration, realms, clients, roles, and administration |
| License boundary | Core and SDK use different licenses | Core services and selected SDK use Apache-2.0 | Server project uses Apache-2.0 |
| Best evaluation method | Prototype one application and organization model | Prototype required services and consent/login flows | Prototype one realm, client, role model, and upgrade process |
Comparison Matrix
Logto
Logto’s current docs describe IAM for modern applications and SaaS products, combining authentication and authorization concepts in one product surface. That is useful when a team wants application-facing identity features without designing every flow around separately operated components. Check the Logto documentation for the exact SDK, organization, role, and deployment support needed by your application.
Ory
Ory documents a headless identity platform. Kratos and Hydra are separate services, so an implementation should model which service owns login, recovery, consent, tokens, and administration. This is a strong fit when the service split matches an existing platform architecture, but it demands more explicit integration work. Use the Ory documentation to validate the current APIs rather than copying old SDK examples.
Keycloak
Keycloak provides a server and administration model centered on realms, clients, users, groups, and roles. It can fit teams that want to operate a full identity server and centralize protocol configuration. Read the Keycloak documentation for the current server, upgrade, and administration surfaces before selecting an image or planning an integration.
Pricing and operating cost
Pricing pages were accessed 2026-08-24. Logto and Ory publish live cloud pricing pages; Keycloak’s selected first-party surface is project documentation rather than a comparable managed-service grid. Any purchase comparison must therefore use vendor-specific rows and include infrastructure costs, engineering time, backups, upgrades, observability, and incident response for self-hosted deployments.
Cloud entitlements also differ. Copy a quota only from a same-day plan row for the named service. MAU, seat, request, and organization limits are not comparable to the capacity of infrastructure that your team operates. Review Logto pricing and Ory pricing immediately before a buying decision.
Release and repository context
At the frozen evidence point, current release records identified Logto v1.42.0, Ory Kratos v26.2.0, Ory Hydra v26.2.0, and Keycloak 26.7.2. The npm records identified @logto/node 3.1.10 and @ory/client 1.22.66. Recheck release identities before publication or upgrade work because project releases can move independently.
The same evidence point recorded Logto at 14,455 stars and 1,182 forks, Ory Kratos at 13,846/1,181, Ory Hydra at 17,495/1,600, and Keycloak at 36,381/8,846. These are repository counters. The dated GitHub counters provide repository-interest context only; they do not measure users, deployment count, growth, maturity, or enterprise adoption.
License boundaries
License review must be artifact-specific. The current records identify Logto core as MPL-2.0 and @logto/node as MIT. Ory Kratos, Ory Hydra, @ory/client, and Keycloak are identified as Apache-2.0. Confirm the license of every server, SDK, adapter, theme, and enterprise component you plan to distribute or modify; a product name is not a substitute for that review.
Integration checklist
Use current vendor documentation to validate only named integrations. A category label such as OIDC or OAuth does not prove that the products share the same protocol profile, social-provider catalog, passkey support, provisioning model, or organization semantics.
Before selection, implement these flows in a disposable environment:
- Sign-up, sign-in, sign-out, and account recovery.
- Session renewal and forced revocation.
- Organization membership and role changes.
- Token claims consumed by the real API.
- Administrator onboarding and audit access.
- Export or migration of users and credentials where supported.
The result should be a documented migration test, not an assumption based on similar terminology.
Performance and operations
There is no reproducible benchmark receipt for cross-product memory, CPU, setup time, latency, or throughput. A useful proof of concept records the exact release, image, runtime configuration, database, identity flows, hardware, warmup, repetitions, and raw output. Without that evidence, compare operational responsibilities instead: upgrade cadence, rollback process, backup and restore, observability, secret rotation, and on-call ownership.
The selected documentation, registry, repository, and latest-release endpoints were reachable at access time, and the four core repositories reported archived=false. This is point-in-time project availability and not an uptime guarantee, support-lifecycle commitment, compliance attestation, or managed-cloud SLA.
Migration Notes
A safe migration sequence is deliberately small:
- Inventory current users, identifiers, credentials, claims, roles, organizations, sessions, and recovery methods.
- Map each item to a documented target capability and mark unsupported cases.
- Build one isolated tenant or realm and connect one non-critical application.
- Test token validation, session expiry, revocation, recovery, and administrator access.
- Rehearse rollback before moving production identities.
- Move in bounded cohorts and keep audit evidence for each cohort.
Do not treat a webhook, adapter, or import endpoint as proof that credential migration and session continuity will work for your data.
Methodology
This refresh uses current docs, pricing pages, registry records, repository metadata, and latest-release endpoints accessed on 2026-08-24. It separates cloud-plan facts from self-hosted operating costs, artifact licenses from product labels, and repository counters from adoption claims. Volatile versions, counters, and plan rows require a fresh check before publication or purchase.
Source-backed FAQ
Which option is the simplest default?
There is no default independent of architecture. Logto concentrates more application-IAM concerns in one product surface, Ory exposes a headless service model, and Keycloak centers a self-hosted identity server and administration model. Prototype the flows your application actually needs.
Can GitHub stars decide this comparison?
No. Repository counters show activity around public repositories at one time. They do not establish operational fit, security posture, support quality, or adoption.
What should a proof of concept measure?
Measure flow correctness, token and session behavior, administration, upgrade and rollback work, backup and restore, and the engineering effort to operate the chosen deployment model. Record configuration and raw results so the test can be repeated.