Use Keycloak when you need a sign-in server

Cost

Open source. Apache-2.0, free to run on your own servers. Hosted identity services are proprietary and paid above a free tier.

How to do it

Keycloak's first production release came in 2014, and 26.8.1 shipped on 13 October 2026. It is Apache-2.0 and a CNCF incubating project since April 2023. Its GitHub repository had about 37,500 stars in October 2026. Since 26.4 it supports passkeys, and it covers second factors, single sign-on and SAML without code of your own. The command kc.sh export writes realms and users to JSON files, and apps speak only OpenID Connect, so any other provider can replace it. Weigh it against a library as Decide whether a provider or a library runs sign-in says. Choose something else when one app has simple sign-in, because a library inside the app needs no extra server to patch.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

JavaScript example

const ISSUER = 'https://id.example.com/realms/shop';

export async function loadIdentityConfig() {
  const response = await fetch(`${ISSUER}/.well-known/openid-configuration`);
  const { authorization_endpoint, token_endpoint, jwks_uri } = await response.json();
  return { authorization_endpoint, token_endpoint, jwks_uri };
}

Python example

import json
import urllib.request

ISSUER = "https://id.example.com/realms/shop"

def load_identity_config() -> dict:
    with urllib.request.urlopen(f"{ISSUER}/.well-known/openid-configuration") as response:
        config = json.load(response)
    return {key: config[key] for key in ("authorization_endpoint", "token_endpoint", "jwks_uri")}

How to check

Each app reads its settings from the realm's discovery document, and no app imports a Keycloak-only client. A kc.sh export run in the last 12 months restored into a test server.

Sources

• Keycloak import and export
• OpenID Connect Discovery 1.0

Related rules

• Decide whether a provider or a library runs sign-in in Accounts