theAuth vs Keycloak

​

What Keycloak documents

​

Where its docs stop

• Approvals bound to call arguments: not found. We did not find it in the CIBA material we read.
• A tamper evident audit chain: not found. The admin guide covers auditing user events and admin events, and we saw no hash chain or integrity mechanism. We read only the first 200k of 688k characters of that guide.
• IoT device principals and MQTT: partly. The Device Authorization Grant exists, but we found MQTT only in third party tutorials, which we did not verify.
• ROS 2 or robotics: not found in Keycloak’s documentation.
• Revocation that reaches exchanged tokens: its token exchange documentation says revoking an access token does not revoke the exchanged access token. A refresh token revocation chain does exist. We did not find multi-hop nested act chains described.

​

How theAuth differs

​

Where Keycloak is ahead

• It is a full identity server with years of production use, a supported standards list, an admin console, themed login pages, and many database backends.
• Device Authorization Grant, CIBA and DPoP are marked Supported today. The theAuth device work is not in a published release.
• It covers SAML, LDAP style federation and social login out of the box. Our SAML verifier has not had an independent audit.

​

Pick theAuth if

• You want auth as a library inside a TypeScript or Go app, with agents and devices as principals.
• You need approvals tied to exact arguments or revocation that reaches issued tokens, and you can run the release branch or wait for it.

​

Pick Keycloak if

• You want a standalone identity server for employees and customers, with a supported standards list.
• You need device grant, CIBA or DPoP now, from a stable release.

​

Related