Keycloak
Fewer than 5 people recommend it so far, so there's no written verdict. Here is what commenters said.
Why people recommend it
“You should take a look at their client adapters, thats what I use.”
“Keycloak is awesome, but whenever I used it the documentation gave me too little guidance.”
Show 1 more
“Or just stick with KeyCloak that offers a full self hosted product...”
Caveats and dissent
“The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link.”
“If you've ever used Keycloak, Spring Security, or similarly convoluted solutions, you know what I'm talking about.”
Often compared with
Who recommends it in their own words
Threads where it came up
- What I self-host 2 mentions
- I used AWS cognito for a startup. I wouldn't do it again 2 mentions
- From Supabase to Clerk to Better Auth 2 mentions
- Keycloak: Unauthenticated account takeover via reset-credentials flow bypass 1 mention
- Ask HN: Freelancer? Seeking freelancer? (September 2026) 1 mention
- Better Auth is joining Vercel 1 mention
Data: keycloak.json. Quotes are verbatim; the verdict and theme labels are written by a model from these comments, and every clause links to its sources.
All comments 12
“The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link.”
“I use it only as id (idp) broker and SSO to authenticate to my apps.”
“keycloak”
“Keycloak SSO”
“You should take a look at their client adapters, thats what I use.”
“We've been using Keycloak for a while, it's definitely not bad, but there are times when it's been frustrating”
“Keycloak is awesome, but whenever I used it the documentation gave me too little guidance.”
“Or just stick with KeyCloak that offers a full self hosted product...”
“It's super straight-forward to implement compared with similar products (Ory Kratos, Keycloak, etc).”
“If you've ever used Keycloak, Spring Security, or similarly convoluted solutions, you know what I'm talking about.”
“A national government is large enough to run their own Keycloak instance”
“OIDC integration (currently using it with Keycloak)”