Keycloak is an open-source identity and access management server, written in Java and licensed under Apache-2.0, that adds authentication and access control to applications and services, and it is intended for teams and organisations that want to own their user store rather than rent one.
What it is
Keycloak is a server that handles authentication and access control for applications and services. The README frames the proposition plainly: add authentication to applications and secure services with minimum effort, with no need to deal with storing users or authenticating users. It lives in the cloud-native ecosystem as a Cloud Native Computing Foundation project, which is visible in its CNCF Code of Conduct, its community Slack hosted at slack.cncf.io, and its CLOMonitor listing under the cncf project path. The project carries OpenSSF Best Practices, OpenSSF Scorecard, and Artifact Hub badges, and it is organised as a family of repositories: the Keycloak server and Java adapters, Keycloak Client libraries, Keycloak QuickStarts, and Keycloak Node.js Connect.
The concrete problem it solves is the piece of every application that should not be written twice: user storage, login flows, and authorisation checks. Instead of building a user table, a password reset flow, a token issuer, and an access policy engine into each service, a team points its applications at Keycloak and lets the server handle user federation, strong authentication, user management, and fine-grained authorization. It speaks the two protocols that matter for integration, OIDC and SAML, so applications that already know those standards need no bespoke glue. The specific product it stands in for is Auth0.
Key capabilities
- Issues and validates tokens over both OIDC and SAML, the two protocols named in the project topics.
- Provides user federation, so identities held in existing directories can be surfaced rather than migrated wholesale.
- Handles strong authentication and user management as server-side features rather than per-application code.
- Applies fine-grained authorization, covering the access-control decisions the README lists alongside authentication.
- Ships as a downloadable distribution run through
bin/kc.[sh|bat] start-dev, and as the Docker image quay.io/keycloak/keycloak.
- Offers a Keycloak Operator, published to Artifact Hub under the
keycloak-operator repository with an OLM community-operators listing.
- Supplies client-side integration through the Keycloak Client libraries, Java adapters, Keycloak QuickStarts, and Keycloak Node.js Connect, with interface translations managed through Weblate.
Who uses it and how
- Teams that would otherwise pay for Auth0 and prefer to run the identity server inside their own infrastructure.
- Kubernetes and OpenShift operators install the Keycloak Operator from Artifact Hub and manage server instances as cluster resources.
- Java shops use the Keycloak server and Java adapters, while Node.js services use Keycloak Node.js Connect, keeping the same identity backend across both.
- Organisations with existing enterprise directories use user federation to bring those identities under a single access-control layer.
- Contributors and integrators work through the community Slack channels
#keycloak and #keycloak-dev, the user mailing list, and community meetings.
Getting started
Download the distribution from the Keycloak website, unzip it, and run bin/kc.[sh|bat] start-dev; alternatively run docker run quay.io/keycloak/keycloak start-dev. The README points to the Keycloak Documentation for anything beyond that first run.
How it compares
Against Auth0, the axis is licensing and where the data sits: Keycloak is Apache-2.0 and designed to run on infrastructure the adopter controls, so user records stay in the operator's own environment. Auth0 is a hosted service, which removes the operational burden but also removes direct control of the identity store and puts cost on a subscription footing rather than on the servers and staff time a self-hosted deployment consumes. Keycloak is the choice when owning the identity layer matters more than avoiding the work of running it.
When to use it — and when not to
Choose Keycloak when identity must live on infrastructure the organisation controls and when OIDC and SAML coverage across mixed Java and Node.js services is the requirement. A self-hoster takes on running, configuring, and upgrading the server, and the README's quickstart deliberately stops at the start-dev flag, deferring production configuration to the documentation site, so a deployment needs someone willing to read those docs rather than a team looking for a zero-operations hosted service. The repository currently carries 3,292 open issues, which reflects both the project's scale and the fact that its issue tracker is a busy place, and the README itself is thin on operational detail beyond the downloads page and documentation links.
project readme (upstream, from github) — read inline
Open Source Identity and Access Management
Add authentication to applications and secure services with minimum effort. No need to deal with storing users or authenticating users.
Keycloak provides user federation, strong authentication, user management, fine-grained authorization, and more.
Help and Documentation
Reporting Security Vulnerabilities
If you have found a security vulnerability, please look at the instructions on how to properly report it.
Reporting an issue
If you believe you have discovered a defect in Keycloak, please open an issue.
Please remember to provide a good summary, description as well as steps to reproduce the issue.
Getting started
To run Keycloak, download the distribution from our website. Unzip and run:
bin/kc.[sh|bat] start-dev
Alternatively, you can use the Docker image by running:
docker run quay.io/keycloak/keycloak start-dev
For more details refer to the Keycloak Documentation.
Building from Source
To build from source, refer to the building and working with the code base guide.
Testing
To run tests, refer to the running tests guide.
Writing Tests
To write tests, refer to the writing tests guide.
Contributing
Before contributing to Keycloak, please read our contributing guidelines. Participation in the Keycloak project is governed by the CNCF Code of Conduct.
Joining a community meeting is a great way to get involved and help shape the future of Keycloak.
Code of Conduct
We are committed to providing a safe, welcoming, and constructive environment for all Keycloak contributors and users.
To protect this space, we actively enforce our Code of Conduct.
If you wish to report an incident or appeal a moderation decision, please email [email protected].
Other Keycloak Projects
License
