Kanidm Hosting Live In 5 Minutes

Kanidm hosting on xCloud gives you a self-hosted identity provider for people, groups and credentials, with OAuth2 and OIDC single sign-on and passkeys. Deploy Kanidm from the OneClick catalog and xCloud starts the pinned 1.11.2 server with an embedded database on a persistent volume and publishes the web UI and endpoints over HTTPS. There is no default login, and your domain becomes its permanent identity, so choose the final one first.

Deploy your Kanidm

No terminal
No technical skills needed
No lock-in, cancel anytime

What is Kanidm?

Kanidm is, in its README's words, a simple and secure identity management platform that lets other applications offload authenticating and storing identities to it. It supports passkeys with WebAuthn, OAuth2 and OIDC single sign-on, an application portal, Linux and Unix integration, SSH key distribution, RADIUS and a read-only LDAPS gateway, with complete command-line tooling. Self-hosted Kanidm is an identity provider you run yourself instead of a hosted one such as Okta. It is licensed under MPL-2.0.

Here on xCloud the template starts Kanidm 1.11.2, pinned by digest, with an embedded SQLite database on the kanidm_data volume. It has no default login, so you recover the admin and idm_admin passwords from the server. The domain is permanent: passkeys, OAuth2 clients and tokens are bound to it. The LDAPS port is not published, and the 1.11 web UI has no create-person button, so you use the command-line client.

From Sign-Up to a Live Identity Provider In Just 3 Easy Steps

A Kanidm setup normally means a server container, an internal certificate, a data volume, a proxy, a domain and a public certificate before the first person is created. This is the same result without assembling any of it.

Step 01
Sign Up
Create your xCloud account and pick Kanidm from the OneClick catalog. Choose your final domain and target server — Kanidm binds to its domain permanently — and leave the form empty, since the template needs no install-form input.
Step 02
We Deploy It For You
One click. We bring up the official Kanidm image pinned by immutable digest, a one-shot certificate-setup container that writes the internal certificate on first boot, and an nginx proxy that is the only published service (on loopback). The kanidm_data volume keeps the database and certificate, and HTTPS is published on your domain.
Step 03
Create The Admin Passwords
Wait about a minute for first boot to create the database. Over SSH, run the two commands on the credentials card to print a one-time password for admin and idm_admin, then sign in as idm_admin and create people and groups.

Everything Kanidm Does, On Your Own Server

Kanidm runs in full here: an identity provider with SSO, passkeys and groups on your own domain, backed by a volume you own.

Single Sign-On For Your Apps
Kanidm provides single sign-on for your applications over OAuth2/OIDC.
Passkeys And TOTP
People in your organisation can authenticate with passkeys and TOTP; give them a credential reset link to enrol a passkey.
People And Groups In One Place
Manage people and groups centrally, with optional POSIX/LDAP views for Linux hosts.
Embedded SQLite Database
There is no separate database service to run; the database lives on the kanidm_data volume.
No Default Login
Kanidm ships without a password: admin and idm_admin are created on demand with a one-time recovery command, and unauthenticated access is rejected.
Data Survives A Restart
The whole data volume — database, internal certificate, created people and groups — survives an xCloud Restart.

Everything You Need To Run Your Identity Provider 24/7

Managed hosting for Kanidm, so the parts that keep it online are not your problem.

Kanidm 1.11.2 deployed instantly
Official image pinned by digest
Admin passwords created on demand
Kept behind xCloud nginx
Free SSL certificate
Server backups and snapshots
Server security updates included
Choose your server region
Unused balance refunded

What You Can Do With Kanidm

Add single sign-on to your apps
Your internal tools authenticate through OAuth2 and OIDC against Kanidm instead of each keeping its own passwords.
Give people passkeys
You send each person a credential reset link, and they enrol a passkey for sign-in instead of a password.
Manage people and groups centrally
An administrator creates people and groups once and grants application access through group membership.
Keep identities on your own server
A team that does not want its user directory in a hosted identity service keeps it in a volume it controls.

Kanidm vs Alternatives

Okta: Okta and Auth0 are hosted identity services. Kanidm is a self-hosted identity provider on a server you run, and this page makes no feature-parity claim.
Keycloak: Keycloak is a separate identity server with its own OneClick page. Kanidm's README lists complete command-line tooling for administration and a web UI for user self-service, so compare the two admin models.
Authelia: Authelia is a separate authentication portal with its own OneClick page, for protecting apps behind a reverse proxy. Kanidm's own goal is a complete identity provider with OAuth2/OIDC, passkeys and groups.
ZITADEL: ZITADEL is a separate identity platform with its own OneClick page. Check its tenancy model and hosting needs against Kanidm's single-server design.
Pocket ID: Pocket ID is a separate OIDC provider with its own OneClick page. Kanidm's feature list also covers Linux/Unix integration, SSH key distribution, RADIUS and a read-only LDAPS gateway.

Simple Pricing. Everything Included.

Dedicated Cloud VPS sizes, pre-configured for Kanidm hosting. Pick the one that fits, and resize any time.

Cloud VPS 6 GB

Cloud VPS 16 GB

More headroom if Kanidm sits alongside the apps it signs in.

$59.99per month

16 GB RAM
6 vCPU cores
200 GB NVMe SSD
30 TB
Unlimited

Get started

Every size is a dedicated Cloud VPS we provision, patch, monitor and restore. Billed monthly with no lock-in — delete the server and the unused balance comes back to your account. Kanidm itself is licensed by Kanidm's maintainers under MPL-2.0.

Docker hosting

Already Have a Server? Bring Your Own

Connect any VPS — DigitalOcean, Vultr, Linode, AWS, Hetzner or bare metal — and deploy Kanidm on it through the same panel, for a per-server management fee instead of a Cloud VPS rental.

Free

Start your journey without cost.

$0forever

1 server
10 sites

Start free

Starter

Professional

The same platform, discounted at 6–10 servers.

$4per server / month

6–10 servers
Unlimited sites
All features included
Bring any VPS provider

Get started

Agency

The same platform, discounted at 11+ servers.

$3per server / month

11+ servers
Unlimited sites
All features included
Bring any VPS provider

Get started

Priced per connected server, so your rate adjusts automatically as you add or remove servers. You pay your own provider for the server itself.

Self-managed hosting

Ready To Run Your Own Identity Provider?

Kanidm on xCloud runs on a dedicated Cloud VPS that we provision, patch, monitor and restore. Deploy faster. Own the server. Stay in control.

Fast Provisioning
Deploy faster using an xCloud Managed Server built with optimized stacks and high-speed SSDs.
Enterprise-grade security
Protect your infrastructure with a free SSL certificate and more advanced security features at no additional cost.
Intuitive Control Panel
From Server creation to application deployment, everything can be managed from our intuitive control panel.

Hear what people are saying about us

See why agencies, developers, startups, and growing businesses choose xCloud to power their projects.

xCloud works really well, I am surprised by its performance being this the release version, I have tried many paid platforms such as runcloud, cloudpages or serveravatar, as well as free platforms such as CyberPanel, CloudPanel or Hestia Control Panel and direct competitors such as SpinupWP and FlyWP. Of all those that I have tried, the platform that works best for WordPress is SpinupWP and I believe that xCloud can reach and surpass that development, its roadmap is promising. Congratulations to the xCloud team, I hope they become the leading platform in the segment, it has all the potential to achieve it!

Brian Geovanny

I've been with runcloud for the last 3 years. However, after trying xcloud for the last month, I'm switching over. They are on a roll with their setup.

Kevin Pineda

I'm moving my servers to xCloud, a cloud control panel by M Asif Rahman and the WPDeveloper team. Their roadmap looks interesting and no, there are no team mates nor API limits with xCloud! #xCloud #wordpress #hosting

Leo Koo

How Cloud Nine Web Elevated Client Experience While Streamlining Hosting Operations using xCloud

Ed Ellingham

xCloud is like having an expert server team on call — without the big agency costs. It's given me back my time and given my clients peace of mind. Highly recommended for freelancers and small teams who want reliable performance and security.

Dumitru Butucel

xCloud isn't just a solution. It's like one of that friend who got your back when you screw things up pretty bad.

Waqar Ahmed

Trust me when I say, once people explore the potential of xCloud they gonna switch from other panels, just keep delivering the best tech, lots of love for the team 😍😍

Rahul Singh

So far my experience has been smooth like silk. I didn't imagine that configuring and managing a VPS would be so easy. As of today, I have deployed 8 sites. The support is good, and they treat users with respect, even if they ask stupid questions (myself included). For the future, I hope for greater flexibility in scheduled backups and more comprehensive and consistent documentation. I'm sure that within a few months, xCloud will become the leader in its segment. This community is amazing, and the Staff here is super helpful.

Massimo Villa

Came from cloudways then to runcloud then to xcloud. Looks like I'm staying here.

Gerson El

I've recently taken all of my Vultr-hosted sites and gotten rid of cPanel for them to substitute it with xCloud. I have to say, I'm really impressed with xCloud so far! The interface is definitely the standout feature for me.

Tony Lewis

I came from Cloudways and won't go back. Highly impressed with xCloud. Glad I gave them a chance.

Jared McDowell

I like xCloud better than RunCloud, but one thing I'll point out is that some years ago RunCloud was hungry for business, the support was outstanding, and the community was active and helped each other. Maybe it was sold, there was a change in management, or they stopped being hungry, but the quality of the RunCloud offering declined and it hasn't been moving forward quickly. My point is that currently the xCloud team has the edge and it is theirs to keep or lose

David McCan

How Kevin Heinrichs Cut Hosting Costs by 84% While Running WooCommerce & Node.js Sites Efficiently

Kevin Heinrichs

I had 150 sites on cloudways and am in the process of moving them to xcloud. Much faster and better priced.

Dan Spinoza

Dear xCloud Team, I have been using xCloud for some time now and am genuinely impressed with its capabilities and the flexibility it offers by allowing users to bring their own VPS for management. It's a fantastic service, and my experience so far has been very positive. Successful migrated 5 sites on a single server. Xcloud migration tool worked great. There were few hiccups with security plugin like MalCare but disabling the plugin prior to migration worked just fine.

Rahil Maknojia

Came from runcloud. Tried xcloud and never came back.

Karl Fanega

How Advanced Web Strategies Saved Over $2,000 & Recovered 56 Hours per Month Managing 70+ Client Websites

Gary Moody

xCloud gave me what no other hosting platform could: the flexibility of a VPS with the convenience of managed WordPress. As a solo founder running an entire business on one server, that combination is an important unfair advantage.

Jorge de los Reyes Martínez

I use Server Avatar and xCloud and I'll sooner use xCloud than Server Avatar personally.

Jay Pagano

How Newman Web Solutions Ensured Perfect Uptime and Seamless Scaling For 120+ WordPress Sites with xCloud

Lori Newman

I too have moved over to xCloud. It's pretty sweet. One click n8n and uptime Kuma apps

John Aperture

I went from Cloudways to xCloud. No intention on switching in the foreseeable future.

Blaine Moore

Frequently Asked Questions

Feel free to contact us with any questions or concerns you may have.

Is Kanidm free?

Yes. Kanidm is open source under MPL-2.0, with its licence text linked at the pinned v1.11.2 tag. xCloud bills for the Cloud VPS under it, not for Kanidm, and there is no per-user fee. Your directory and credentials belong entirely to you, on your own server.

Can you self-host Kanidm with Docker?

Yes, and this Kanidm Docker hosting template does it for you: the official kanidm/server image, pinned by digest, runs behind an nginx proxy with an internal certificate on your own server, with HTTPS in front. It is not a Kanidm cloud account, so identities stay with you.

How much RAM does Kanidm need?

At its floor, Kanidm wants 512 MB of RAM, because it uses an embedded SQLite database. The 6 GB tier offered here leaves room above that floor. Directory size and sign-in load add to usage, so watch memory as your users grow.

How do I sign in to Kanidm the first time?

Kanidm has no default password. Over SSH, run the recover-account commands from the credentials card to print a one-time password for admin and idm_admin. Each password is shown only once, so store it. Then use the kanidm command-line client with your HTTPS address as the server.

What is the difference between admin and idm_admin in Kanidm?

admin manages the server itself, such as its configuration. idm_admin manages people and groups. Use idm_admin for day-to-day identity work and keep admin for server settings, and keep both passwords private. Neither account has a default password.

How do I create people in Kanidm?

The 1.11 web UI has no create-person button, so use the kanidm command-line client with your HTTPS address as the server, or the API. Then send each person a credential reset link so they can enrol a passkey. Create groups and OAuth2 clients the same way.

Is LDAP available in Kanidm?

LDAPS on port 3636 is off and is not published by the template. Enabling the LDAP bind address in the environment only exposes it inside the compose network. If you need LDAP for legacy systems, plan the access carefully, since the port is not reachable from outside.

Can I change the Kanidm domain later?

Not safely. The site domain is the server's permanent identity, and passkeys, OAuth2 clients and tokens are bound to it. If it changes, Kanidm refuses to start until the domain rename procedure has been run, and registered passkeys stop working. Choose the final domain first.

How do I back up Kanidm?

Stop the stack and copy the whole kanidm_data volume, which holds the database, the internal certificate and key, the admin socket and any online backups. The built-in online backup writes inside the same volume, so copy it off the server too. Test a restore.

Backup and restore Docker apps

How do I upgrade Kanidm?

Catalog changes never rewrite a running 1.11.2 install, so a newer template version only arrives when you adopt it. Back up the volume first and read the upstream release notes, since Kanidm releases can include migrations. Then sign in with the client and confirm a user and a passkey still work.

Can I cancel anytime?

Yes. There is no lock-in — cancel any time. Hosting is billed monthly and charged for what you actually use, so when you delete the server the unused balance is refunded to your account, less up to 10% in payment-processing fees.