We've been using Keycloak for a while, it's definitely not bad, but there are times when it's been frustrating, and getting it both stable and scalable seem to be incompatible goals.

It's super powerful and can do whatever you want it to do (at least if you are comfortable writing Java SPI). But there's a lot of knowledge of how to set things up that takes time and is not readily acquired.

For the record we looked at Ory early on, but it was not mature enough and didn't offer a full IdP stack at the time. We've since looked again and found there to be some conventions around how it works that made it hard for us to consider migrating from Keycloak.

WorkOS is incredible, even if you don't need any of the "enterprise" features and you're building an entirely B2C app.

Ory has a really good config and deployment story, Keycloak is more feature rich.

Personally I choose Keycloak, but Ory is not a bad choice at all if you are willing to do more upfront work.

Used all 3, I would go with Ory.