Add passkeys and adaptive MFA to Keycloak. Without migrating off it.

Q: What does it cost to integrate with Authsignal?

You can start integrating on our free tier immediately — up to 1,000 monthly active users at no cost. For production deployments, plans start at $1,099/month. Enterprise pricing is available for larger deployments.

Authsignal drops in on top of your Keycloak instance via the browser authentication flow. Ship phishing-resistant passkeys, a no-code rules engine, and pre-built UI. Live in weeks, not months.

Book a demo View docs

Delivering world-class results for:

Keycloak vs. Authsignal + Keycloak

Capability

Keycloak alone

Authsignal + Keycloak

Passkey Support

Built into the browser login forms, but nothing ships for native iOS or Android

Embedded passkeys anywhere in your app. Pre-built UI or SDKs for web and native mobile

MFA Options

TOTP, WebAuthn and recovery codes only. SMS, email OTP and push mean community JARs or your own SPI

+ SMS, email OTP, push, WhatsApp OTP, biometrics, magic links, all built in

Adaptive Authentication

No built-in adaptive or risk-based MFA. Requires custom SPI development

Visual no-code rules engine. Deploy adaptive policies in minutes, not sprints

Policy Configuration

Admin console and Keycloak SPIs for custom authentication flows

No-code visual builder. Product, fraud, and compliance teams configure directly

Customization & UX

Theme-based customisation. Limited without frontend development

Fully brandable pre-built UI, or embed via SDKs into your existing application

Implementation

Open-source and self-managed. No commercial support. Custom SPIs for advanced flows

Browser flow integration with Authsignal extension. Pre-built UI or headless SDKs. Live in weeks

Fastest way to integrate MFA and passkeys with Keycloak

Ship passkeys and adaptive MFA without building custom Keycloak SPIs

Replace self-managed authentication extensions with a managed, no-code rules engine

Phishing-resistant authentication live in weeks, with pre-built UI or your own custom implementation

From daunting rebuild to shipped in weeks

Drop-in

Drop in, no need to rip and replace

Your Keycloak investment stays. Authsignal layers on top of your existing instance via the browser authentication flow. No user migration. No database changes. Your team ships modern authentication in weeks.

SECURITY

Adaptive security without the friction

The no-code rules engine applies the right authentication at the right moment, challenging high-risk actions with step-up MFA while keeping low-risk logins fast. Product, fraud, and compliance teams set the rules. Engineering ships once.

JOURNEY

Beyond login, across the customer journey

Passkeys at sign-in. Step-up at transaction. Verification at account recovery. Authsignal orchestrates authentication at every sensitive touchpoint, not just the login screen, all from a single integration.

3 ways to integrate with Keycloak

“Implementing FIDO authentication through Authsignal has been a game-changer for our members’ digital experience. It’s secure, seamless and sets a new standard for trust in online banking.”

Herb Wulff

Treasury and Agency

Treasury and Agency Banking Manager

Partnering with Authsignal is simple and powerful

Start with a guided evaluation

Talk to our team to scope your integration and see a live demo tailored to your stack. Or get going today with a free trial.

Integration made easy

Follow our step-by-step guides to get up and running without friction.

Dedicated solutions engineering

Access real-time support via private Slack channel for tailored advice from our engineering team.

Flexible options

Drop-in authentication for production-grade security and compliance. Extend your existing identity stack, or replace it.

FAQ

Do I need to migrate my users off Keycloak?

No. Authsignal connects to your Keycloak instance via the browser authentication flow. Your user directory, sessions, and existing realms all stay in place. Authsignal adds capabilities on top. It doesn't replace anything underneath.

Does Authsignal replace the need for custom Keycloak SPIs?

For authentication orchestration, yes. Authsignal provides passkeys, adaptive MFA, a no-code rules engine, and pre-built UI out of the box. These are capabilities that would otherwise require building and maintaining custom Keycloak SPIs. You still manage your Keycloak instance for identity management and session handling.

Why choose Authsignal?

Deploy passkeys and MFA in weeks instead of months. Flexible integration options including pre-built UI, UI components, or headless SDKs. A visual no-code rules engine for adaptive authentication policies. Real-time developer support, comprehensive documentation, and step-by-step integration guides. SOC 2 Type 2, ISO 27001, and FIDO Alliance certified.

What does it cost to integrate with Authsignal?

You can start integrating on our free trial immediately. For production deployments, plans start at $1,099/month. Enterprise pricing is available for larger deployments. See our pricing page for details.

Which MFA methods does Authsignal support?

Passkeys (FIDO2/WebAuthn), biometrics, SMS OTP, email OTP, WhatsApp OTP, push notifications, authenticator apps (TOTP), and magic links. All methods are available from a single integration and managed via the no-code rules engine.

What programming languages and SDKs are supported?

Server SDKs for Node.js, Python, Ruby, Java, C#, PHP, and Go. Client SDKs for Web (JavaScript/TypeScript), React Native, iOS (Swift), and Android (Kotlin). Plus a REST API for any language.