Tools / Keycloak / Keycloak vs WorkOS
Open-source identity and access management with single sign-on.
Keycloak is an open-source identity and access management system. Applications delegate login to Keycloak instead of handling their own login forms and user storage. Users authenticate once with Keycloak and can then access any connected application without logging in again — and single-sign out works the same way, so logging out once logs them out of all applications.
Enterprise auth: SSO, SCIM, and audit logs.
WorkOS is an auth and user management platform aimed at developers whose apps need to sell to enterprise customers. Its core products cover Enterprise SSO (with support for any identity provider), Directory Sync for user lifecycle management from corporate directories, Audit Logs for event logging and streaming, Multi-Factor Authentication, Role-Based Access Control, and an Admin Portal that lets corporate IT admins onboard themselves. It also ships AuthKit, a customizable hosted UI for authentication flows, and a broader User Management platform that ties these together. Beyond the core auth stack, the site lists Radar for real-time bot, fraud, and abuse protection; Vault for encryption and key management of objects; MCP Auth for securing MCP servers; Pipes for app and agent integrations; auth.md for user registration by agents; Airlock for intent-based access control; and Atlas, described as an AI coworker. Documentation, a changelog, API status page, pricing, and support plans are all available on the site.