Keycloak is a build decision. Midships Keycloak is a buy.

Some vendors tell buyers the choice is between building on open source Keycloak and buying their platform. For raw Keycloak, that is fair. It is not the choice in front of you: Midships Keycloak is bought, and it arrives with the production platform already built.

Compare five-year cost ↗Get a renewal decision review ↗

Three options, not two

Build it, license it, or buy it built.

The build versus buy framing hides a third option. Here is what each one actually gives you.

	Build it yourselfOpen source Keycloak	License a platformA licensed or SaaS identity product	Buy Midships KeycloakSubscription, production ready
What you are buying	Source code and a community	A licence to the vendor's product, per identity or per active user	A subscription to a production identity platform, priced on the deployment
Production platform on day one	You build it: infrastructure, high availability, pipelines, monitoring	You or a partner configure and engineer it, typically over months	Included: infrastructure as code, high availability patterns, hardened baseline, promotion pipelines, monitoring
Authentication journeys	Your engineers design and build each one	Specialists configure each one in the product	Built with Caravel from a versioned specification, to Midships standards every time
Upgrades	Your problem	On the vendor's release cycle, delivered by your programme	Rehearsed upgrade patterns, with rollback
Support and operations	Community forums, or your own team	Vendor product support; operations are yours or a partner's	Platform support, and Guardian operations if you want them
Cost as you grow	Infrastructure only	Rises with identities or active users	Fixed subscription, independent of identity numbers
Where it runs	Anywhere	Vendor cloud, or your environment for self-managed software	Your data centre or your own cloud tenancy
If you leave	Nothing to leave	Migration programme	The Keycloak core is open source; your configuration and journeys are yours

01, The myth

Buying a licence does not buy you production.

Every enterprise identity platform is a delivery programme. A licence gives you powerful components. It does not give you environments, configuration as code, promotion between environments, high availability across sites, performance tuning, monitoring or the journeys your customers use. Someone has to build all of that, whichever product you choose.

We know this from the inside. Midships has delivered and operated licensed identity platforms for banks for more than eight years. In our experience, configuring, deploying and tuning a production estate takes months, and each programme ends up building its own pipelines. We built accelerators for exactly that reason, including the DevSecOps pipelines.

So the real question is not build or buy. It is how much of the delivery arrives already built, and whether you pay per identity for the rest of the platform's life.

02, What you buy

The subscription includes the platform.

Midships Keycloak packages what we learned building and running identity platforms for tier 1 and tier 2 banks: infrastructure as code for Kubernetes, high availability and multi-region patterns, a hardened baseline applied to every build, promotion pipelines with rollback, monitoring, and rehearsed upgrades. It runs in your environment, and the Keycloak core stays open source.

Journeys are built with Caravel, our AI-led delivery framework. Each journey starts from a versioned specification and is checked against the same tests, so every journey meets the same Midships standard, and creating a new one is faster than configuring it by hand.

You can run it with your own team, or add Guardian, operated by the people who built it, inside your own tenancy.

03, The evidence

Built by people who have run bank identity estates.

In 2025 Midships completed four complex migrations and upgrades of bank identity estates, in four countries, all at tier 1 or tier 2 banks. Midships Keycloak is now being delivered at a tier 1 bank in South East Asia, with production go-live from December 2026. Read the CIAM Migration Diary for how that migration is being run.

Being fair

When each option is right.

Build it yourself

You have a strong platform engineering team, simple journeys, and the appetite to own identity end to end.

License a platform

You want the vendor to run it as SaaS, your identity numbers are stable, and per identity cost is acceptable.

Buy Midships Keycloak

You want a bank-grade platform you own, in your own environment, delivered and supported, without paying more as your customers grow.

Common questions

Frequently asked questions.

Is Keycloak a build or a buy decision?

Open source Keycloak on its own is a build decision: your team assembles and runs the platform. Midships Keycloak is a buy decision: a subscription that arrives with the production platform, journeys and operations model already built.

Is Keycloak enterprise ready?

Keycloak is a Cloud Native Computing Foundation project used in production by large enterprises. What makes it enterprise ready in a bank is the platform around it: high availability, hardened configuration, pipelines, upgrades and operations. That is what Midships Keycloak provides.

Who supports Midships Keycloak?

Midships supports the platform under the subscription, and can operate it for you through Guardian. If you want Red Hat product support for the Keycloak software itself, Midships Keycloak runs on the Red Hat build.

Does licensed software really take months to configure?

In our experience delivering licensed identity platforms for banks, configuring, deploying and tuning a production estate typically takes months. That is why we built accelerators.

More comparisons