Keycloak Step-Up Authentication
Configure Keycloak step-up authentication with LoA 1 password and LoA 2 OTP, map silver and gold ACR values, request acr_values from an OIDC client, step up from an existing SSO session, decode the acr claim, and handle …
Keycloak Recovery Codes
Learn how to enable Keycloak recovery codes, generate and store backup codes, use Try another way for 2FA recovery, and regenerate spent codes.
Keycloak Conditional Authentication Flows
Learn how Keycloak Conditional subflows evaluate built-in conditions, compare Conditional OTP Form with role-gated MFA subflows, combine Condition user role and user configured, test a four-state matrix, and debug …
Keycloak Required Actions
What Keycloak Required Actions are, how to assign them, when they run at login or by email, and how to troubleshoot pending UPDATE_PASSWORD, VERIFY_EMAIL, and CONFIGURE_TOTP on Keycloak 26.7.3.
Keycloak Passwordless Authentication
Learn how Keycloak passwordless authentication works with passkeys, WebAuthn, identity providers, and magic links, including enrollment, migration, and account recovery.
Keycloak TOTP Two-Factor Authentication
Enable Keycloak TOTP 2FA with realm OTP policy, Configure OTP required actions, authenticator app enrollment, browser login with OTP, selective enforcement patterns, lost-device credential reset, recovery-code handoff, …
Keycloak SMTP Configuration: Configure and Test Email
Configure Keycloak realm SMTP in the Admin Console, choose SSL or STARTTLS, test email delivery, authenticate with password or XOAUTH2, and fix common connection errors on Keycloak 26.7.3.
Keycloak Passkeys and WebAuthn Tutorial
Enable Keycloak 26.7.3 passkeys and WebAuthn passwordless login, register platform passkeys and security keys, configure RP ID and conditional UI, compare second-factor WebAuthn, and troubleshoot origin and missing …
Configure Forgot Password in Keycloak
Enable Keycloak forgot password with realm SMTP, test reset-credentials email links, compare safe responses for unknown usernames, fix missing buttons and mail failures, and handle expired action tokens on Keycloak …
Keycloak Password Policy
Configure Keycloak realm password policy for length, history, expiry, blacklist, and regex rules, separate user-facing checks from Argon2 or PBKDF2 hashing parameters, test when policies apply to existing users, and …
Keycloak Custom Authentication Flow: Require OTP by Role
Copy the Keycloak browser flow, add a Group MFA conditional subflow that requires OTP for users with realm role mfa-lab-required, bind browserFlow safely, test four login scenarios, and export realm configuration on …
Keycloak Authentication Flows Explained
Learn how Keycloak composes browser login from flows, subflows, and executions; how Required, Alternative, Conditional, and Disabled requirements evaluate; default Browser flow walkthrough, bindings, safe duplication, …
Keycloak Implicit Flow: Should You Still Use It?
What Keycloak Implicit Flow is, why response_type=token is discouraged for new SPAs, how it differs from Authorization Code with PKCE, and how to migrate and disable implicit flow on Keycloak 26.7.3.
Keycloak DPoP
Bind Keycloak access tokens to a client-held EC key with DPoP proof JWTs, request sender-constrained tokens on Keycloak 26.7.3, verify proofs at a resource API, and reproduce replay and key-mismatch failures.
Keycloak Direct Access Grants: Why ROPC Is Unsafe and What to Use Instead
What Keycloak Direct Access Grants means, why grant_type=password is discouraged, common token-endpoint errors, and safer replacements (PKCE, device flow, client credentials) on Keycloak 26.7.3.
Keycloak Pushed Authorization Requests (PAR)
Push OAuth authorization parameters to Keycloak with PAR, complete Authorization Code flow using request_uri on Keycloak 26.7.3, and enforce PAR per client with confidential client authentication.
Keycloak Standard Token Exchange
Configure Keycloak Standard Token Exchange v2 with subject_token, requester client scopes, audience filtering, claim comparison before and after exchange, and troubleshooting invalid_target and access_denied errors on …
Keycloak Logout and OIDC RP-Initiated Logout
Configure Keycloak RP-initiated logout with id_token_hint and post_logout_redirect_uri, compare front-channel and backchannel logout across two clients, and diagnose stale app sessions on Keycloak 26.7.3.
Keycloak JWKS and JWT Signature Verification
Discover Keycloak issuer and JWKS URI, verify RS256 access token signatures locally with kid lookup, validate iss aud and exp claims, reject ID tokens at APIs, and handle unknown kid after key rotation on Keycloak …
Keycloak Token Revocation
Revoke Keycloak access and refresh tokens with the RFC 7009 endpoint, compare introspection and local JWT checks after revocation, and choose between endpoint revoke, logout, session termination, and client secret …
Keycloak CIBA Authentication
Configure Keycloak Client Initiated Backchannel Authentication on a confidential client, run a minimal HTTP authentication channel, post a login_hint backchannel request, and poll with auth_req_id for access tokens on …
Keycloak Token Introspection
POST access tokens to Keycloak token introspection with curl and a confidential client, read active true or false after expiry logout and audience mismatch, and compare local JWT verification on Keycloak 26.7.3.
Keycloak Device Authorization Grant
Walk through Keycloak Device Authorization Grant on a public CLI client: request device and user codes, poll with interval and slow_down, complete browser verification, and call UserInfo after approval.
Keycloak Offline Tokens
Request Keycloak offline tokens with offline_access through Authorization Code flow, refresh after SSO logout, tune Offline Session Idle and Max Limited, rotate and revoke safely, and compare offline refresh tokens with …
Keycloak Client Credentials Grant
Request a Keycloak client_credentials access token with curl and HTTP Basic auth, decode service-account claims (sub, azp, aud, roles), check audience and roles at orders-api, and tell token-endpoint 401 apart from API …
Keycloak Refresh Tokens
Use Keycloak refresh tokens with curl, enable Revoke Refresh Token and Max Reuse, relate refresh_expires_in to client and SSO sessions, and diagnose invalid_grant after logout, idle timeout, or token reuse on Keycloak …
Keycloak PKCE Tutorial: Authorization Code Flow with S256
Configure Keycloak PKCE on a public client with S256, generate a code verifier and challenge, complete Authorization Code flow, and prove a stolen code fails without the verifier on Keycloak 26.7.3.
Keycloak Authorization Code Flow
Walk through Keycloak Standard Flow with a confidential server-side client: build the authorization URL, exchange the code with curl, validate state and nonce, refresh tokens, and reproduce common invalid_grant errors.
Keycloak Sessions Explained: User, Client and Offline Sessions
Learn how Keycloak user sessions, client sessions and offline sessions work, how they relate to tokens and SSO, and how to view or revoke them.
Keycloak OpenID Connect Tutorial
Configure a public Keycloak OIDC client with PKCE, run Authorization Code flow, inspect ID and access JWTs, call UserInfo, and validate the bearer token at a small Python API on Keycloak 26.7.3.