6 ms·

I’ve been pondering a deep dive into Keycloak or Ory. Or is WorkOS good enough for the price? I’m looking to centralize account management across multiple syste

I’ve been pondering a deep dive into Keycloak or Ory. Or is WorkOS good enough for the price? I’m looking to centralize account management across multiple systems.

adithyareddy 22d ago
WorkOS is incredible, even if you don't need any of the "enterprise" features and you're building an entirely B2C app.
NegativeLatency 22d ago
Used all 3, I would go with Ory.
- vinckr 22d ago
  Just out of interest, what makes you choose Ory over Keycloak/WorkOs?
  - NegativeLatency 21d ago
    Keycloak is a big complex java app that does everything in one service, clustering and everything, all kinds of plugins and stuff you can make it do what you want at a price. WorkOS has messed up SCIM integrations for us/our customers serveral times, and now with agentic stuff I'd just build out SCIM support myself (done it pre agents so maybe not for everyone), they're also kinda expensive and have hard lockin since they're not going to hand out your customer SAML/SCIM/whatever configs and password hashes. Ory's got a nice cloud offering (only used it self hosted) but the whole stack is there and it's IMO easier to understand than keycloak (and you probably don't want to build your own) I would also rather admin/bug fix/operate a go service than a java service (personally). Keycloak is not terrible though you have enough rope to really get yourself in a bind.
sceptic123 22d ago
We've been using Keycloak for a while, it's definitely not bad, but there are times when it's been frustrating, and getting it both stable and scalable seem to be incompatible goals. It's super powerful and can do whatever you want it to do (at least if you are comfortable writing Java SPI). But there's a lot of knowledge of how to set things up that takes time and is not readily acquired. For the record we looked at Ory early on, but it was not mature enough and didn't offer a full IdP stack at the time. We've since looked again and found there to be some conventions around how it works that made it hard for us to consider migrating from Keycloak.
DarmokTanagra 22d ago
Ory has a really good config and deployment story, Keycloak is more feature rich. Personally I choose Keycloak, but Ory is not a bad choice at all if you are willing to do more upfront work.

I’ve been pondering a deep dive into Keycloak or Ory. Or is WorkOS good enough for the price? I’m looking to centralize account management across multiple systems.

adithyareddy 22d ago

WorkOS is incredible, even if you don't need any of the "enterprise" features and you're building an entirely B2C app.

NegativeLatency 22d ago

Used all 3, I would go with Ory.

vinckr 22d ago
Just out of interest, what makes you choose Ory over Keycloak/WorkOs?
- NegativeLatency 21d ago
  Keycloak is a big complex java app that does everything in one service, clustering and everything, all kinds of plugins and stuff you can make it do what you want at a price. WorkOS has messed up SCIM integrations for us/our customers serveral times, and now with agentic stuff I'd just build out SCIM support myself (done it pre agents so maybe not for everyone), they're also kinda expensive and have hard lockin since they're not going to hand out your customer SAML/SCIM/whatever configs and password hashes. Ory's got a nice cloud offering (only used it self hosted) but the whole stack is there and it's IMO easier to understand than keycloak (and you probably don't want to build your own) I would also rather admin/bug fix/operate a go service than a java service (personally). Keycloak is not terrible though you have enough rope to really get yourself in a bind.

sceptic123 22d ago

We've been using Keycloak for a while, it's definitely not bad, but there are times when it's been frustrating, and getting it both stable and scalable seem to be incompatible goals. It's super powerful and can do whatever you want it to do (at least if you are comfortable writing Java SPI). But there's a lot of knowledge of how to set things up that takes time and is not readily acquired. For the record we looked at Ory early on, but it was not mature enough and didn't offer a full IdP stack at the time. We've since looked again and found there to be some conventions around how it works that made it hard for us to consider migrating from Keycloak.

DarmokTanagra 22d ago

Ory has a really good config and deployment story, Keycloak is more feature rich. Personally I choose Keycloak, but Ory is not a bad choice at all if you are willing to do more upfront work.