I've run keycloak securing internet facing apps with ~1000 users for years. It's so stable, I usually forget it's even there.