Is this a drop-in replacement for Keycloak?
No. Keycloak is a general identity server with SAML, LDAP federation, themeable login pages and an admin console. Nautilus does one narrower job: sign-in and user accounts for the customers of a SaaS product, behind an HTTP API with no screens of its own. If you need SAML or single sign-on for enterprise customers, keep Keycloak. If what you run it for is password login, Google and GitHub, recovery, two-factor and the roles inside your customers' organizations, this is the part you can stop hosting. Organizations, roles and members are managed through the API, and the dashboard has no screen for members yet. A user's roles come back in the signed token, in token introspection and in the session check.
Do I still have to build login screens?
Yes, the screens. Nautilus returns each step as an API response and your code submits what the user typed, so the forms look like the rest of your product. What you stop building is everything behind them: password storage, recovery and verification emails, sessions, provider logins. If you want a hosted login page you can theme, Keycloak has one and this does not.
How do I verify a webhook?
Every delivery carries svix-id, svix-timestamp and svix-signature headers: an HMAC-SHA256 signature over the id, the timestamp and the raw body. Check it with the official open-source Svix library, which exists for Node, Python, Go, Rust, PHP, Java, Ruby, C# and Kotlin, rather than writing the check yourself. Failed deliveries are retried and can be resent from the dashboard.
What does it cost?
Free up to 1,000 active users a month, no card. An active user is someone who signs in at least once in a calendar month, however many times; people you create through the API who never sign in are not counted. Pro is €99 a month for 10,000 active users and Advanced €199 for 50,000. Roles and organizations come with every plan, Free included, and the audit log is kept for 7, 30 or 90 days by plan; neither is an add-on with its own price. Past your limit sign-in is never blocked: you are emailed at 80% and 100%, and you get time to move up before new registrations are refused. The current list is on the pricing page.
What is running underneath?
Ory Kratos, the open-source identity server, as one shared deployment for all accounts. The dashboard, the API keys, the webhooks, organizations and roles, the signed tokens and the check that keeps one account's users away from another's are ours, on top. The trade-off of sharing it: the user schema is fixed to an email, a locale and your JSON field, and you cannot change Kratos's own configuration. The engine is open, so if you outgrow that, the same software runs on your own servers. The layer we built on top does not come with it. To move elsewhere, ask support for an export of all your users with their password hashes, social links, metadata, organizations and roles: you get one encrypted file within 7 days, in a format our own import accepts and that maps onto Ory Kratos.
Where is identity data stored?
Identities, sessions and your custom metadata are stored in databases on our own servers in France, at OVHcloud. Outgoing email, such as sign-in and recovery codes, is delivered through Resend, a US provider, under the European Commission's Standard Contractual Clauses.
How do roles and permission checks work?
You create an organization, define roles in it (a role is a name and a list of permissions such as invoices:write), and add a user to the organization with one role. To check, call authorize with the user, the permission and the organization: you get allowed or not, with a reason and the role. Or read the roles from the signed token and let your database policy decide. Permissions are matched exactly, with no wildcards. A role that someone holds cannot be deleted until they are moved. A membership can carry a deadline and be removed by a rule when it passes. Every change to a role or membership is in the audit log.
What does it not do?
No SAML or enterprise single sign-on, no hosted login page, no prebuilt components, no passkeys, no SMS codes and no Sign in with Apple. It is not an OAuth or OpenID provider for third parties: the signed token is there to be verified, and Nautilus has no authorization endpoint. The emails we send for you come from Verne's address and are written in your user's language (six languages, from the user's locale). Official SDKs cover Node, Python, PHP and Rust.
How does it compare with Auth0, Clerk, Ory Network or Logto?
There is a page on each, with their prices from their own sites and the date we checked. In short: they are ahead on prebuilt screens, enterprise single sign-on and the number of sign-in methods. We are ahead on rules that delete unused accounts, on roles and organizations without an add-on price and, compared with Clerk, on where the data sits. Read the pages, then decide. The pages are in English.