Keycloak

No entries match these filters. Clear filters

1. 1.0 Oct 5, 2026 · issue 095
   API change

   • + PUT /admin/realms/{realm}/organizations/{org-id}/identity-providers/{alias}
   • + PUT /admin/realms/{realm}/organizations/{org-id}/members/{member-id}/membership-type
   • ~ GET /admin/realms: response schema changed
   • ~ GET /admin/realms/{realm}: response schema changed
   • ~ GET /admin/realms/{realm}/clients/{client-uuid}/roles/{role-name}/groups: response schema changed
   • ~ GET /admin/realms/{realm}/identity-provider/instances: response schema changed
   • ~ GET /admin/realms/{realm}/identity-provider/instances/{alias}: response schema changed
   • ~ GET /admin/realms/{realm}/organizations: param identityProvider (query) added; response schema changed
   • ~ GET /admin/realms/{realm}/organizations/count: param identityProvider (query) added
   • ~ GET /admin/realms/{realm}/organizations/members/{member-id}/organizations: response schema changed
   • ~ GET /admin/realms/{realm}/organizations/{org-id}: response schema changed
   • ~ GET /admin/realms/{realm}/organizations/{org-id}/groups/group-by-path/{path}: param briefRepresentation (query) added
   • ~ GET /admin/realms/{realm}/organizations/{org-id}/identity-providers: response schema changed
   • ~ GET /admin/realms/{realm}/organizations/{org-id}/identity-providers/{alias}: response schema changed
   • ~ GET /admin/realms/{realm}/organizations/{org-id}/members/{member-id}/organizations: response schema changed
   • ~ GET /admin/realms/{realm}/roles/{role-name}/groups: response schema changed
   • ~ POST /admin/realms/{realm}/clients/{client-uuid}/nodes: response schema changed
   • ~ POST /admin/realms/{realm}/identity-provider/instances: request body changed
   • ~ POST /admin/realms/{realm}/organizations: request body changed
   • ~ POST /admin/realms/{realm}/organizations/{org-id}/members/invite-user: param client_id (query) added
   • ~ POST /admin/realms/{realm}/partial-export: response schema changed
   • ~ PUT /admin/realms/{realm}: request body changed
   • ~ PUT /admin/realms/{realm}/identity-provider/instances/{alias}: request body changed
   • ~ PUT /admin/realms/{realm}/organizations/{org-id}: request body changed
   • ⚠ POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/download
   • ⚠ POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/generate
   • ⚠ POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/generate-and-download
   • ⚠ POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/upload
   └──▷ BREAKING ON UPGRADE

   • !Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/download (still works)
   • !Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/generate (still works)
   • !Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/generate-and-download (still works)
   • !Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/upload (still works)
2. changelog Oct 5, 2026 · issue 095

   Keycloak: Adds a new client policy executor to restrict the may_act claim in access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions., giving per-client control over which clients can participate in delegation.

   └──▷ TRY IT
   Enable the OID4VPOID4VPAn OpenID Foundation protocol for presenting verifiable credentials to a verifier over OAuth 2.0 flows, giving cyber tools a standard way to request and receive identity proofs without custom integrations. verifier so users can authenticate by presenting verifiable credentials from their wallets instead of a password.
   copy

   $ bin/kc.sh start --features=oid4vc-vci,oid4vc-vp

   Enable stateless multi-cluster v2 to connect two Keycloak clusters without an external Infinispan cache, storing sessions in the database.
   copy

   $ bin/kc.sh start --features=stateless

   Enable the Client Admin APIAdmin APIA dedicated HTTP interface that exposes management and configuration operations separately from the data plane, letting cyber tools automate provisioning, policy changes, or monitoring without touching the main user-facing service. v2 for declarative, strictly validated OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user./SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. client management with an accurate OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec.
   copy

   $ bin/kc.sh start --features=client-admin-api:v2

   • Promotes Client Admin API v2 from experimental to preview, now enabled with --features=client-admin-api:v2 or --features=preview, supporting declarative OIDC and SAML client management with strict validation and an accurate OpenAPI specification.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Multi-cluster v1 (the infinispan feature) is deprecated and will be removed in a future major release; migrate to multi-cluster v2 using --features=stateless.
3. 1.0 Oct 4, 2026 · issue 094
   API change

   • + PUT /admin/realms/{realm}/organizations/{org-id}/identity-providers/{alias}
   • + PUT /admin/realms/{realm}/organizations/{org-id}/members/{member-id}/membership-type
   • ~ GET /admin/realms: response schema changed
   • ~ GET /admin/realms/{realm}: response schema changed
   • ~ GET /admin/realms/{realm}/clients/{client-uuid}/roles/{role-name}/groups: response schema changed
   • ~ GET /admin/realms/{realm}/identity-provider/instances: response schema changed
   • ~ GET /admin/realms/{realm}/identity-provider/instances/{alias}: response schema changed
   • ~ GET /admin/realms/{realm}/organizations: param identityProvider (query) added; response schema changed
   • ~ GET /admin/realms/{realm}/organizations/count: param identityProvider (query) added
   • ~ GET /admin/realms/{realm}/organizations/members/{member-id}/organizations: response schema changed
   • ~ GET /admin/realms/{realm}/organizations/{org-id}: response schema changed
   • ~ GET /admin/realms/{realm}/organizations/{org-id}/groups/group-by-path/{path}: param briefRepresentation (query) added
   • ~ GET /admin/realms/{realm}/organizations/{org-id}/identity-providers: response schema changed
   • ~ GET /admin/realms/{realm}/organizations/{org-id}/identity-providers/{alias}: response schema changed
   • ~ GET /admin/realms/{realm}/organizations/{org-id}/members/{member-id}/organizations: response schema changed
   • ~ GET /admin/realms/{realm}/roles/{role-name}/groups: response schema changed
   • ~ POST /admin/realms/{realm}/clients/{client-uuid}/nodes: response schema changed
   • ~ POST /admin/realms/{realm}/identity-provider/instances: request body changed
   • ~ POST /admin/realms/{realm}/organizations: request body changed
   • ~ POST /admin/realms/{realm}/organizations/{org-id}/members/invite-user: param client_id (query) added
   • ~ POST /admin/realms/{realm}/partial-export: response schema changed
   • ~ PUT /admin/realms/{realm}: request body changed
   • ~ PUT /admin/realms/{realm}/identity-provider/instances/{alias}: request body changed
   • ~ PUT /admin/realms/{realm}/organizations/{org-id}: request body changed
   • ⚠ POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/download
   • ⚠ POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/generate
   • ⚠ POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/generate-and-download
   • ⚠ POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/upload
   └──▷ BREAKING ON UPGRADE

   • !Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/download (still works)
   • !Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/generate (still works)
   • !Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/generate-and-download (still works)
   • !Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/upload (still works)
4. changelog Oct 4, 2026 · issue 094

   Keycloak 26.8.0 adds OID4VPOID4VPAn OpenID Foundation protocol for presenting verifiable credentials to a verifier over OAuth 2.0 flows, giving cyber tools a standard way to request and receive identity proofs without custom integrations. credential verification, SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. API support, multi-cluster stateless mode, token delegation with FGAP, and a wave of preview promotions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Enable OID4VP verifier support so users can authenticate by presenting verifiable credentials from their digital wallets.
   copy

   $ bin/kc.sh start --features=oid4vc-vp

   Enable multi-cluster v2 stateless mode so two Keycloak clusters share session state via the database, with no external Infinispan required.
   copy

   $ bin/kc.sh start --features=stateless

   • Enables OID4VCIOID4VCIAn OpenID Foundation protocol for issuing verifiable credentials to a digital wallet over OAuth 2.0, giving cyber tools a standard way to request and receive cryptographically signed identity claims. with --features=oid4vc-vci or --features=preview; adds experimental oid4vc-mdoc format support, credential revocation on refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. revocation, and an Application Initiated Action for in-session credential issuance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds oid4vc-vp experimental feature for OID4VP verifier support, enabling cross-device wallet credential presentations with direct_post.jwt encrypted response mode and SD-JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. User Attribute and Session mappers.
   • Promotes multi-cluster v2 (--features=stateless) to supported, enabling multi-cluster deployments without an external Infinispan cluster by storing session data in the database.
   • Promotes SCIM API to supported, adding multivalued user attributes, User Profile permissions, Fine-Grained Admin Permissions in search filters, and improved performance for large user bases.
   • Auto-creates delegation:user and delegation:client client scopes as Optional scopes in all realms, with delegation authorization controlled via Fine-Grained Admin Permissions V2 delegate and delegate-members scopes.

   +17 more show less

   • Adds secure-client-node-hostname client policy executor to validate cluster node hostnames against admin-configured regex patterns on the /clients-managements/register-node endpoint, preventing SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly..
   • Adds allowed-protocol-mappers executor to Client Policies to restrict protocol mapper types creatable via Admin REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. protocol mapper endpoints.
   • Adds invite-user workflow step that automatically sends an action-token email when a user is created, with configurable required actions, client, and redirect URI.
   • Enriches CODE_TO_TOKEN, REFRESH_TOKEN, and other token lifecycle events with impersonator and impersonator_id details, and includes a non-disableable act claim in access and ID tokens for impersonation sessions.
   • Promotes Client Secret Rotation to supported, allowing confidential clients to hold up to two concurrently active secrets for zero-downtime rotation via client policies.
   • Promotes Client Admin APIAdmin APIA dedicated HTTP interface that exposes management and configuration operations separately from the data plane, letting cyber tools automate provisioning, policy changes, or monitoring without touching the main user-facing service. v2 to preview, enabled with --features=client-admin-api:v2 or --features=preview, with a Java client, auto-generated JavaScript client, CLI, and Operator KeycloakClient custom resources.
   • Promotes Parameterized scopes (formerly dynamic scopes) to preview, allowing clients to pass a parameter value with the scope name in OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. authorization requests.
   • Emits account-disabled and account-enabled RISC event types from the experimental Shared Signals Framework (SSF) when a user is enabled or disabled.
   • Adds support for encrypted PEM files for TLS certificate and private key configuration.
   • Stores login failures in the database instead of in-memory.
   • Adds first-class CLI options for cluster and node name.
   • Adds automatic non-blocking index creation for large database tables.
   • Adds experimental Vert.x-based outbound HTTP client.
   • Adds experimental Helm Chart Operator install support.
   • Adds shared identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. across organizations.
   • Redesigns identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. buttons on the login page.
   • Generated system truststore uses BCFKS format in strict FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. mode.
   • Enables OID4VCIOID4VCIAn OpenID Foundation protocol for issuing verifiable credentials to a digital wallet over OAuth 2.0, giving cyber tools a standard way to request and receive cryptographically signed identity claims. with --features=oid4vc-vci or --features=preview; adds experimental oid4vc-mdoc format support, credential revocation on refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. revocation, and an Application Initiated Action for in-session credential issuance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds oid4vc-vp experimental feature for OID4VP verifier support, enabling cross-device wallet credential presentations with direct_post.jwt encrypted response mode and SD-JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. User Attribute and Session mappers.
   • Auto-creates delegation:user and delegation:client client scopes as Optional scopes in all realms, with delegation authorization controlled via Fine-Grained Admin Permissions V2 delegate and delegate-members scopes.
   • Adds secure-client-node-hostname client policy executor to validate cluster node hostnames against admin-configured regex patterns on the /clients-managements/register-node endpoint, preventing SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly..
   • Adds allowed-protocol-mappers executor to Client Policies to restrict protocol mapper types creatable via Admin REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. protocol mapper endpoints.

   +8 more show less

   • Adds invite-user workflow step that automatically sends an action-token email when a user is created, with configurable required actions, client, and redirect URI.
   • Enriches CODE_TO_TOKEN, REFRESH_TOKEN, and other token lifecycle events with impersonator and impersonator_id details, and includes a non-disableable act claim in access and ID tokens for impersonation sessions.
   • Adds support for encrypted PEM files for TLS certificate and private key configuration.
   • Adds first-class CLI options for cluster and node name.
   • Adds automatic non-blocking index creation for large database tables.
   • Adds experimental Vert.x-based outbound HTTP client.
   • Adds experimental Helm Chart Operator install support.
   • Adds shared identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. across organizations.

   9 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Multi-cluster v1 (the multi-site feature) is deprecated and will be removed in a future major release; migrate to multi-cluster v2 using --features=stateless.
5. 1.0 Oct 3, 2026 · issue 093

   API surface changed: +2 endpoints, 22 modified, 4 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +2 endpoints, 22 modified, 4 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + PUT /admin/realms/{realm}/organizations/{org-id}/identity-providers/{alias}
   • + PUT /admin/realms/{realm}/organizations/{org-id}/members/{member-id}/membership-type
   • ~ GET /admin/realms: response schema changed
   • ~ GET /admin/realms/{realm}: response schema changed
   • ~ GET /admin/realms/{realm}/clients/{client-uuid}/roles/{role-name}/groups: response schema changed
   • ~ GET /admin/realms/{realm}/identity-provider/instances: response schema changed
   • ~ GET /admin/realms/{realm}/identity-provider/instances/{alias}: response schema changed
   • ~ GET /admin/realms/{realm}/organizations: param identityProvider (query) added; response schema changed
   • ~ GET /admin/realms/{realm}/organizations/count: param identityProvider (query) added
   • ~ GET /admin/realms/{realm}/organizations/members/{member-id}/organizations: response schema changed
   • ~ GET /admin/realms/{realm}/organizations/{org-id}: response schema changed
   • ~ GET /admin/realms/{realm}/organizations/{org-id}/groups/group-by-path/{path}: param briefRepresentation (query) added
   • ~ GET /admin/realms/{realm}/organizations/{org-id}/identity-providers: response schema changed
   • ~ GET /admin/realms/{realm}/organizations/{org-id}/identity-providers/{alias}: response schema changed
   • ~ GET /admin/realms/{realm}/organizations/{org-id}/members/{member-id}/organizations: response schema changed
   • ~ GET /admin/realms/{realm}/roles/{role-name}/groups: response schema changed
   • ~ POST /admin/realms/{realm}/clients/{client-uuid}/nodes: response schema changed
   • ~ POST /admin/realms/{realm}/identity-provider/instances: request body changed
   • ~ POST /admin/realms/{realm}/organizations: request body changed
   • ~ POST /admin/realms/{realm}/organizations/{org-id}/members/invite-user: param client_id (query) added
   • ~ POST /admin/realms/{realm}/partial-export: response schema changed
   • ~ PUT /admin/realms/{realm}: request body changed
   • ~ PUT /admin/realms/{realm}/identity-provider/instances/{alias}: request body changed
   • ~ PUT /admin/realms/{realm}/organizations/{org-id}: request body changed
   • ⚠ POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/download
   • ⚠ POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/generate
   • ⚠ POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/generate-and-download
   • ⚠ POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/upload
   • New endpoint PUT /admin/realms/{realm}/organizations/{org-id}/identity-providers/{alias}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New endpoint PUT /admin/realms/{realm}/organizations/{org-id}/members/{member-id}/membership-type
   • GET /admin/realms/{realm}/organizations: param identityProvider (query) added
   • GET /admin/realms/{realm}/organizations/count: param identityProvider (query) added
   • GET /admin/realms/{realm}/organizations/{org-id}/groups/group-by-path/{path}: param briefRepresentation (query) added

   +1 more show less

   • POST /admin/realms/{realm}/organizations/{org-id}/members/invite-user: param client_id (query) added

   6 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/download (still works)
   • !Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/generate (still works)
   • !Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/generate-and-download (still works)
   • !Deprecated endpoint POST /admin/realms/{realm}/clients/{client-uuid}/certificates/{attr}/upload (still works)
6. announced Oct 1, 2026 · issue 093

   Keycloak: Promotes multi-cluster v2 and the stateless feature to supported, enabling multi-cluster Keycloak without an external Infinispan cluster; enabled with --features=stateless.

   └──▷ TRY IT
   Run a multi-cluster Keycloak deployment without an external Infinispan cluster by enabling the stateless feature.
   copy

   $ bin/kc.sh start --features=stateless

   Enable OID4VCIOID4VCIAn OpenID Foundation protocol for issuing verifiable credentials to a digital wallet over OAuth 2.0, giving cyber tools a standard way to request and receive cryptographically signed identity claims. credential issuance and the experimental mdoc format in a single start command.
   copy

   $ bin/kc.sh start --features=oid4vc-vci,oid4vc-mdoc

   Enable the Client Admin APIAdmin APIA dedicated HTTP interface that exposes management and configuration operations separately from the data plane, letting cyber tools automate provisioning, policy changes, or monitoring without touching the main user-facing service. v2 to manage OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. clients declaratively with strict validation and an accurate OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec.
   copy

   $ bin/kc.sh start --features=client-admin-api:v2

   • Adds token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. delegation to preview using the new delegation:client:<client-id> parameterized scope, inserting an act claim identifying the delegating client, with Fine-Grained Admin Permissions V2 delegate and delegate-members scopes controlling authorization and a new client policy executor restricting may_act claims.

   1 detail in Everything

7. Keycloak 26.8.0 released (2026-10-01) Oct 1, 2026 · issue 091

   Keycloak 26.8 adds supported SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. API and multi-cluster stateless mode, OID4VCIOID4VCIAn OpenID Foundation protocol for issuing verifiable credentials to a digital wallet over OAuth 2.0, giving cyber tools a standard way to request and receive cryptographically signed identity claims./OID4VPOID4VPAn OpenID Foundation protocol for presenting verifiable credentials to a verifier over OAuth 2.0 flows, giving cyber tools a standard way to request and receive identity proofs without custom integrations. credentials, and token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. delegation for AI agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Start Keycloak in multi-cluster v2 stateless mode to connect clusters without an external Infinispan deployment.
   copy

   $ bin/kc.sh start --features=stateless

   Enable OID4VCI verifiable credential issuance and the experimental mdoc format in a single startup flag.
   copy

   $ bin/kc.sh start --features=oid4vc-vci,oid4vc-mdoc

   • Enables --features=stateless to run multi-cluster v2 deployments without an external Infinispan cluster, storing session data in the database instead.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Enables --features=preview or --features=oid4vc-vci to activate OID4VCI verifiable credential issuance (promoted from experimental to preview), with credential revocation on refresh-token revocation and a new Application Initiated Action for in-session credential requests.
   • Adds experimental oid4vc-mdoc feature flag for mdoc credential format support.
   • Enables --features=preview or --features=client-admin-api:v2 to activate the Client Admin APIAdmin APIA dedicated HTTP interface that exposes management and configuration operations separately from the data plane, letting cyber tools automate provisioning, policy changes, or monitoring without touching the main user-facing service. v2 (promoted to preview), providing strict validation, declarative configuration, and an accurate OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. clients.
   • Promotes the SCIM API to supported, adding multivalued user attributes, User Profile permissions, Fine-Grained Admin Permissions in search filters, and improved performance for large user bases.

   +14 more show less

   • Adds delegation:client:<client-id> parameterized scope for OAuth consent-based token exchange delegation, producing tokens with an act claim identifying the delegated client as the actor.
   • Auto-creates delegation:user and delegation:client client scopes as Optional scopes in all realms, with delegation authorization controlled through Fine-Grained Admin Permissions V2 using delegate and delegate-members scopes.
   • Adds secure-client-node-hostname client policy executor to validate cluster node registration hostnames against administrator-configured regex patterns, protecting against SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. via the legacy adapter endpoint /clients-managements/register-node.
   • Adds allowed-protocol-mappers client policy executor to restrict which protocol mapper types can be created or updated through Admin REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. protocol mapper endpoints.
   • Adds invite-user workflow step that sends an action-token email automatically when a user is created, with configurable required actions and optional client and redirect URI.
   • Enriches token lifecycle events (CODE_TO_TOKEN, REFRESH_TOKEN, and others) with impersonator and impersonator_id details, and includes the act claim (RFC 8693RFC 8693An IETF standard defining the OAuth 2.0 Token Exchange flow, letting a service swap one token for another with different scopes, audience, or type — enabling delegation and impersonation without re-authenticating the user. Section 4.1) in access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. and ID tokens issued from impersonation sessions.
   • Adds OID4VP verifier support (experimental) enabling authentication flows where users present verifiable credentials from digital wallets, supporting cross-device presentation flows and direct_post.jwt encrypted response mode.
   • Adds SD-JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. User Attribute and Session mappers to extract claims from verifiable credentials presented via OID4VP.
   • Adds RISC account-disabled and account-enabled event types to the experimental Shared Signals Framework (SSF) support.
   • Promotes parameterized scopes (formerly dynamic scopes) from experimental to preview, allowing clients to pass a parameter value with the scope name (e.g. project:12345) in OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. authorization requests.
   • Promotes Client Secret Rotation from preview to supported, allowing confidential clients to keep up to two concurrently active secrets during rotation via client policies.
   • Adds a new client policy executor to restrict the may_act claim in access tokens, giving per-client control over which clients can participate in delegation.
   • Promotes KeycloakOIDCClient and KeycloakSAMLClient Operator custom resources to preview, enabling declarative client management via the Keycloak Operator.
   • Publishes a new deployment guide for multi-cluster v2 on bare-metal and VM environments alongside the existing Kubernetes guide.
   • Enables --features=stateless to run multi-cluster v2 deployments without an external Infinispan cluster, storing session data in the database instead.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds experimental oid4vc-mdoc feature flag for mdoc credential format support.
   • Adds delegation:client:<client-id> parameterized scope for OAuth consent-based token exchange delegation, producing tokens with an act claim identifying the delegated client as the actor.
   • Auto-creates delegation:user and delegation:client client scopes as Optional scopes in all realms, with delegation authorization controlled through Fine-Grained Admin Permissions V2 using delegate and delegate-members scopes.
   • Adds secure-client-node-hostname client policy executor to validate cluster node registration hostnames against administrator-configured regex patterns, protecting against SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. via the legacy adapter endpoint /clients-managements/register-node.

   +7 more show less

   • Adds allowed-protocol-mappers client policy executor to restrict which protocol mapper types can be created or updated through Admin REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. protocol mapper endpoints.
   • Adds invite-user workflow step that sends an action-token email automatically when a user is created, with configurable required actions and optional client and redirect URI.
   • Enriches token lifecycle events (CODE_TO_TOKEN, REFRESH_TOKEN, and others) with impersonator and impersonator_id details, and includes the act claim (RFC 8693RFC 8693An IETF standard defining the OAuth 2.0 Token Exchange flow, letting a service swap one token for another with different scopes, audience, or type — enabling delegation and impersonation without re-authenticating the user. Section 4.1) in access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. and ID tokens issued from impersonation sessions.
   • Adds OID4VP verifier support (experimental) enabling authentication flows where users present verifiable credentials from digital wallets, supporting cross-device presentation flows and direct_post.jwt encrypted response mode.
   • Adds SD-JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. User Attribute and Session mappers to extract claims from verifiable credentials presented via OID4VP.
   • Adds a new client policy executor to restrict the may_act claim in access tokens, giving per-client control over which clients can participate in delegation.
   • Publishes a new deployment guide for multi-cluster v2 on bare-metal and VM environments alongside the existing Kubernetes guide.

   7 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Multi-cluster v1 (the multi-site feature) is deprecated and will be removed in a future major release; the recommended replacement is multi-cluster v2 enabled with --features=stateless.
   • !The Shared Signals Framework event structure has been revised for better alignment with CAEP and RISC specifications; existing consumers of SSF events should review the updated payload shapes.
   • !The admin event store no longer receives unvalidated SSF payloads to prevent PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. leakage.
8. 1.0 Aug 20, 2026 · issue 051

   API surface changed: 2 modified

   API change

   API surface changed: 2 modified

   • ~ GET /admin/realms/{realm}/clients/{client-uuid}/roles/{role-name}/groups: param max (query) added; param 100 (query) removed
   • ~ GET /admin/realms/{realm}/roles/{role-name}/groups: param max (query) added; param 100 (query) removed
   └──▷ BREAKING ON UPGRADE

   • !GET /admin/realms/{realm}/clients/{client-uuid}/roles/{role-name}/groups: param max (query) added; param 100 (query) removed
   • !GET /admin/realms/{realm}/roles/{role-name}/groups: param max (query) added; param 100 (query) removed
9. 1.0 Aug 4, 2026 · issue 035

   API surface changed: 7 deprecated

   API change

   API surface changed: 7 deprecated

   • ⚠ GET /admin/realms/{realm}/authentication/executions/{executionId}/config/{id}
   • ⚠ GET /admin/realms/{realm}/client-scopes/{client-scope-id}/scope-mappings
   • ⚠ GET /admin/realms/{realm}/client-templates/{client-scope-id}/scope-mappings
   • ⚠ GET /admin/realms/{realm}/clients/{client-uuid}/scope-mappings
   • ⚠ POST /admin/realms/{realm}/authentication/config
   • ⚠ POST /admin/realms/{realm}/testSMTPConnection
   • ⚠ PUT /admin/realms/{realm}/users/{user-id}/reset-password-email
   └──▷ BREAKING ON UPGRADE

   • !Deprecated endpoint GET /admin/realms/{realm}/authentication/executions/{executionId}/config/{id} (still works)
   • !Deprecated endpoint GET /admin/realms/{realm}/client-scopes/{client-scope-id}/scope-mappings (still works)
   • !Deprecated endpoint GET /admin/realms/{realm}/client-templates/{client-scope-id}/scope-mappings (still works)
   • !Deprecated endpoint GET /admin/realms/{realm}/clients/{client-uuid}/scope-mappings (still works)
   • !Deprecated endpoint POST /admin/realms/{realm}/authentication/config (still works)
   • !Deprecated endpoint POST /admin/realms/{realm}/testSMTPConnection (still works)
   • !Deprecated endpoint PUT /admin/realms/{realm}/users/{user-id}/reset-password-email (still works)
10. Multi-Cluster v2 and Stateless Mode now in Preview (2026-07-17) Jul 17, 2026 · issue 018

    Keycloak 26.7 adds stateless mode preview, moving auth sessions and brute-force counters to the DB to enable simpler multi-cluster deployments.

    ▶ ⤢
    └──▷ TRY IT
    Start a single Keycloak node (or cluster) with stateless mode enabled to persist auth sessions and brute-force counters in PostgreSQL.
    copy

    $ bin/kc.sh start \
      --features=stateless \
      --spi-cache-embedded--default--cluster-name=CLUSTER1 \
      --db=postgres --db-url=jdbc:postgresql://db-host/keycloak \
      --db-username=keycloak --db-password=<password>

    Add a second independent cluster pointing at the same synchronously replicated database to achieve multi-cluster v2 failover with no Infinispan.
    copy

    $ bin/kc.sh start \
      --features=stateless \
      --spi-cache-embedded--default--cluster-name=CLUSTER2 \
      --db=postgres --db-url=jdbc:postgresql://db-host/keycloak \
      --db-username=keycloak --db-password=<password>

    • New stateless preview feature stores authentication sessions, action tokens, and brute-force counters in the database instead of distributed Infinispan caches.
    • Enables Multi-Cluster v2: two or more independent Keycloak clusters connected only through a synchronously replicated database, with no external Infinispan cluster required.
    • Cross-cluster cache invalidation now uses a database outbox/queuing table with a default polling interval of 100 ms, eliminating direct network connections between clusters.
    • Authentication sessions survive full cluster restarts during minor upgrades, keeping users mid-login from losing progress.
    • Multi-cluster failover is now environment-agnostic — not tied to Kubernetes or a specific cloud provider — using any synchronously replicated database (tested with Amazon Aurora PostgreSQL) and an external load balancer (tested with AWS Global Accelerator).

    +1 more show less

    • Removes dependency on external Infinispan cluster for multi-site setups, eliminating its monitoring and failover/failback operational overhead.

    6 details in Everything

11. Multi-Cluster v2 and Stateless Mode now in Preview (2026-07-17) Jul 17, 2026 · issue 003

    Keycloak 26.7 adds stateless mode preview, moving auth sessions and brute-force counters to the DB to enable simpler multi-cluster deployments.

    ▶ ⤢
    └──▷ TRY IT
    Start a single Keycloak node (or cluster) with stateless mode enabled to persist auth sessions and brute-force counters in PostgreSQL.
    copy

    $ bin/kc.sh start \
      --features=stateless \
      --spi-cache-embedded--default--cluster-name=CLUSTER1 \
      --db=postgres --db-url=jdbc:postgresql://db-host/keycloak \
      --db-username=keycloak --db-password=<password>

    Add a second independent cluster pointing at the same synchronously replicated database to achieve multi-cluster v2 failover with no Infinispan.
    copy

    $ bin/kc.sh start \
      --features=stateless \
      --spi-cache-embedded--default--cluster-name=CLUSTER2 \
      --db=postgres --db-url=jdbc:postgresql://db-host/keycloak \
      --db-username=keycloak --db-password=<password>

    • New stateless preview feature stores authentication sessions, action tokens, and brute-force counters in the database instead of distributed Infinispan caches.
    • Enables Multi-Cluster v2: two or more independent Keycloak clusters connected only through a synchronously replicated database, with no external Infinispan cluster required.
    • Cross-cluster cache invalidation now uses a database outbox/queuing table with a default polling interval of 100 ms, eliminating direct network connections between clusters.
    • Authentication sessions survive full cluster restarts during minor upgrades, keeping users mid-login from losing progress.
    • Multi-cluster failover is now environment-agnostic — not tied to Kubernetes or a specific cloud provider — using any synchronously replicated database (tested with Amazon Aurora PostgreSQL) and an external load balancer (tested with AWS Global Accelerator).

    +1 more show less

    • Removes dependency on external Infinispan cluster for multi-site setups, eliminating its monitoring and failover/failback operational overhead.

    6 details in Everything

12. Keycloak 26.7.0 released (2026-07-09) Jul 9, 2026 · issue 014

    Keycloak 26.7.0 adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. API preview, SSF real-time signals, AuthZen PDP, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. step-up auth, and a new Admin APIAdmin APIA dedicated HTTP interface that exposes management and configuration operations separately from the data plane, letting cyber tools automate provisioning, policy changes, or monitoring without touching the main user-facing service. v2.

    └──▷ TRY IT
    Enable the SCIM API preview so HR systems or identity governance platforms can provision and deprovision users automatically.
    copy

    $ bin/kc.sh start --features=scim-api

    Enable real-time SSF security event delivery so downstream apps learn about logouts and credential changes without waiting for token refresh.
    copy

    $ bin/kc.sh start --features=ssf

    Enable the AuthZen PDP endpoint so PEPs can request standardized permit/deny decisions without coupling to Keycloak's proprietary authorization API.
    copy

    $ bin/kc.sh start --features=authzen

    • Adds SCIM API (preview) for automating user and group provisioning and deprovisioning via standard CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information., PATCH, filtering, pagination, and schema discovery endpoints.
    • Adds OpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. Shared Signals Framework (SSF) Transmitter support (experimental), pushing signed Security Event Tokens to relying parties via push (RFC 8935) and poll (RFC 8936) delivery with durable outbox and retry logic.
    • Adds AuthZen Evaluation API (experimental) implementing the OpenID AuthZENOpenID AuthZENAn emerging standard from the OpenID Foundation that defines a common API for querying authorization engines, letting cyber tools swap policy decision points without rewriting integration code. Authorization API 1.0, exposing single and batch PDP evaluation endpoints for vendor-neutral authorization decisions.
    • Promotes step-up authentication for SAML clients to supported status, enabling SAML service providers to request specific authentication context classes.
    • Adds Identity Brokering API v2 with client-level authorization, confidential-clients-only enforcement, OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms.-compliant POST endpoint, and a new session-based token storage option.

    +6 more show less

    • Adds Identity Assertion JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. Authorization Grant (ID-JAG) support (experimental), allowing Keycloak to accept cross-domain identity assertions and issue access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. without re-authentication.
    • Adds token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. delegation (experimental) with a new delegation parameterized scope type that validates impersonation rights before granting token exchange.
    • Introduces Admin API v2 (experimental) for declarative OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. and SAML client management with strict validation, accurate OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec, and Java/JavaScript/CLI clients.
    • Adds fine-grained delegation for organization administration, introducing dedicated admin roles and Fine-Grained Admin Permissions for organizations.
    • Adds OID4VCIOID4VCIAn OpenID Foundation protocol for issuing verifiable credentials to a digital wallet over OAuth 2.0, giving cyber tools a standard way to request and receive cryptographically signed identity claims. credential refresh interval configuration via vc.refresh_interval_in_seconds in client scope settings, plus admin UI support for all OID4VCI settings and user-initiated credential issuance from the account console.
    • Adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. authorization documentation for Claude Code as a new MCP client integration alongside existing VS Code support.

    11 details in Everything

13. Keycloak 26.7.0 released (2026-07-09) Jul 9, 2026 · issue 003

    Keycloak 26.7.0 adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. API preview, SSF real-time signals, AuthZen PDP, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. step-up auth, and a new Admin APIAdmin APIA dedicated HTTP interface that exposes management and configuration operations separately from the data plane, letting cyber tools automate provisioning, policy changes, or monitoring without touching the main user-facing service. v2.

    └──▷ TRY IT
    Enable the SCIM API preview so HR systems or identity governance platforms can provision and deprovision users automatically.
    copy

    $ bin/kc.sh start --features=scim-api

    Enable real-time SSF security event delivery so downstream apps learn about logouts and credential changes without waiting for token refresh.
    copy

    $ bin/kc.sh start --features=ssf

    Enable the AuthZen PDP endpoint so PEPs can request standardized permit/deny decisions without coupling to Keycloak's proprietary authorization API.
    copy

    $ bin/kc.sh start --features=authzen

    • Adds SCIM API (preview) for automating user and group provisioning and deprovisioning via standard CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information., PATCH, filtering, pagination, and schema discovery endpoints.
    • Adds OpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. Shared Signals Framework (SSF) Transmitter support (experimental), pushing signed Security Event Tokens to relying parties via push (RFC 8935) and poll (RFC 8936) delivery with durable outbox and retry logic.
    • Adds AuthZen Evaluation API (experimental) implementing the OpenID AuthZENOpenID AuthZENAn emerging standard from the OpenID Foundation that defines a common API for querying authorization engines, letting cyber tools swap policy decision points without rewriting integration code. Authorization API 1.0, exposing single and batch PDP evaluation endpoints for vendor-neutral authorization decisions.
    • Promotes step-up authentication for SAML clients to supported status, enabling SAML service providers to request specific authentication context classes.
    • Adds Identity Brokering API v2 with client-level authorization, confidential-clients-only enforcement, OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms.-compliant POST endpoint, and a new session-based token storage option.

    +6 more show less

    • Adds Identity Assertion JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. Authorization Grant (ID-JAG) support (experimental), allowing Keycloak to accept cross-domain identity assertions and issue access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. without re-authentication.
    • Adds token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. delegation (experimental) with a new delegation parameterized scope type that validates impersonation rights before granting token exchange.
    • Introduces Admin API v2 (experimental) for declarative OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. and SAML client management with strict validation, accurate OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec, and Java/JavaScript/CLI clients.
    • Adds fine-grained delegation for organization administration, introducing dedicated admin roles and Fine-Grained Admin Permissions for organizations.
    • Adds OID4VCIOID4VCIAn OpenID Foundation protocol for issuing verifiable credentials to a digital wallet over OAuth 2.0, giving cyber tools a standard way to request and receive cryptographically signed identity claims. credential refresh interval configuration via vc.refresh_interval_in_seconds in client scope settings, plus admin UI support for all OID4VCI settings and user-initiated credential issuance from the account console.
    • Adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. authorization documentation for Claude Code as a new MCP client integration alongside existing VS Code support.

    11 details in Everything

14. Keycloak 26.7.0 released (2026-07-09) Jul 9, 2026 · issue 002

    Keycloak 26.7.0 adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. API preview, SSF real-time signals, AuthZen PDP, SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. step-up auth, and a new Admin APIAdmin APIA dedicated HTTP interface that exposes management and configuration operations separately from the data plane, letting cyber tools automate provisioning, policy changes, or monitoring without touching the main user-facing service. v2.

    └──▷ TRY IT
    Enable the SCIM API preview so HR systems or identity governance platforms can provision and deprovision users automatically.
    copy

    $ bin/kc.sh start --features=scim-api

    Enable real-time SSF security event delivery so downstream apps learn about logouts and credential changes without waiting for token refresh.
    copy

    $ bin/kc.sh start --features=ssf

    Enable the AuthZen PDP endpoint so PEPs can request standardized permit/deny decisions without coupling to Keycloak's proprietary authorization API.
    copy

    $ bin/kc.sh start --features=authzen

    • Adds SCIM API (preview) for automating user and group provisioning and deprovisioning via standard CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information., PATCH, filtering, pagination, and schema discovery endpoints.
    • Adds OpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. Shared Signals Framework (SSF) Transmitter support (experimental), pushing signed Security Event Tokens to relying parties via push (RFC 8935) and poll (RFC 8936) delivery with durable outbox and retry logic.
    • Adds AuthZen Evaluation API (experimental) implementing the OpenID AuthZENOpenID AuthZENAn emerging standard from the OpenID Foundation that defines a common API for querying authorization engines, letting cyber tools swap policy decision points without rewriting integration code. Authorization API 1.0, exposing single and batch PDP evaluation endpoints for vendor-neutral authorization decisions.
    • Promotes step-up authentication for SAML clients to supported status, enabling SAML service providers to request specific authentication context classes.
    • Adds Identity Brokering API v2 with client-level authorization, confidential-clients-only enforcement, OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms.-compliant POST endpoint, and a new session-based token storage option.

    +6 more show less

    • Adds Identity Assertion JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. Authorization Grant (ID-JAG) support (experimental), allowing Keycloak to accept cross-domain identity assertions and issue access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. without re-authentication.
    • Adds token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. delegation (experimental) with a new delegation parameterized scope type that validates impersonation rights before granting token exchange.
    • Introduces Admin API v2 (experimental) for declarative OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. and SAML client management with strict validation, accurate OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec, and Java/JavaScript/CLI clients.
    • Adds fine-grained delegation for organization administration, introducing dedicated admin roles and Fine-Grained Admin Permissions for organizations.
    • Adds OID4VCIOID4VCIAn OpenID Foundation protocol for issuing verifiable credentials to a digital wallet over OAuth 2.0, giving cyber tools a standard way to request and receive cryptographically signed identity claims. credential refresh interval configuration via vc.refresh_interval_in_seconds in client scope settings, plus admin UI support for all OID4VCI settings and user-initiated credential issuance from the account console.
    • Adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. authorization documentation for Claude Code as a new MCP client integration alongside existing VS Code support.

    11 details in Everything

15. Experimental Shared Signals Framework support (2026-07-03) Jul 3, 2026 · issue 014

    Keycloak gains experimental OpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. Shared Signals Framework (SSF) 1.0 Transmitter support, pushing signed SETs to receivers in seconds.

    └──▷ TRY IT
    Enable the experimental SSF Transmitter feature when starting Keycloak so the per-realm SSF endpoints become available.
    copy

    $ kc.sh start-dev --feature-ssf=enabled

    Obtain a client-credentials token scoped to SSF management, then use it to create or manage streams against the Keycloak SSF transmitter endpoints.
    copy

    $ curl -s -X POST "https://my.keycloak.test/realms/myrealm/protocol/openid-connect/token" \
      -d "grant_type=client_credentials" \
      -d "client_id=caep-receiver" \
      -d "client_secret=…" \
      -d "scope=ssf.read ssf.manage"

    Enable the SSF Transmitter for a realm and create an SSF-enabled OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. receiver client, then configure its stream settings via the Admin Console.
    📍In the Admin Console: 1. Open the target realm → Settings → SSF Transmitter toggle → On (sets ssf.transmitterEnabled). 2. Go to Clients → Create client, set Client authentication On, Service accounts roles enabled. 3. On the client's SSF tab: enable SSF, set Default Subjects to ALL, add an Audience (e.g. https://caep.dev), and tick Push and Poll as supported delivery methods. 4. Under Client scopes, add ssf.read and ssf.manage as Optional scopes.
    • Adds experimental SSF 1.0 Transmitter role: Keycloak now pushes signed Security Event Tokens (SETs) to subscribed receivers for identity events such as session revocation, credential change, and account disable.
    • Supports CAEP 1.0 and RISC 1.0 event profiles, automatically mapping native Keycloak events (login, logout, credential change, session revocation) to the correct standardised event types.
    • Supports both HTTP push (RFC 8935) and HTTP poll (RFC 8936, return-immediately) delivery channels for SET distribution.
    • Introduces a transactional outbox: events are durably persisted in the same transaction that produced them, then drained asynchronously with exponential backoff, decoupling generation from delivery.
    • New synthetic event REST endpoint lets external tools (e.g. SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared./IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. platforms) inject events that did not originate inside Keycloak — useful for bridging external credential-change signals.

    +5 more show less

    • Configures SSF Receivers as standard OIDC clients with a per-client ssf.enabled toggle, ssf.read/ssf.manage scopes, and a defaultSubjects policy of ALL or NONE.
    • Adds per-receiver event filter (emit-only-events allowlist) so each receiver subscribes only to the event types it needs.
    • Ships legacy SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. CAEP draft profile for Apple Business Manager and Apple School Manager interoperability, enabling Keycloak to act as a federated IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. for Apple device fleets.
    • Exposes full stream CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. plus status, verification, and stream-config endpoints; streams and subjects are manageable via both the Admin REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. and new Admin Console SSF tabs.
    • Adds Prometheus metrics under the keycloak_ssf_* namespace covering dispatcher, drainer, poll endpoints, verification flow, outbox depth, and per-delivery counters and latencies.

    10 details in Everything

16. Experimental Shared Signals Framework support (2026-07-03) Jul 3, 2026 · issue 003

    Keycloak gains experimental OpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. Shared Signals Framework (SSF) 1.0 Transmitter support, pushing signed SETs to receivers in seconds.

    └──▷ TRY IT
    Enable the experimental SSF Transmitter feature when starting Keycloak so the per-realm SSF endpoints become available.
    copy

    $ kc.sh start-dev --feature-ssf=enabled

    Obtain a client-credentials token scoped to SSF management, then use it to create or manage streams against the Keycloak SSF transmitter endpoints.
    copy

    $ curl -s -X POST "https://my.keycloak.test/realms/myrealm/protocol/openid-connect/token" \
      -d "grant_type=client_credentials" \
      -d "client_id=caep-receiver" \
      -d "client_secret=…" \
      -d "scope=ssf.read ssf.manage"

    Enable the SSF Transmitter for a realm and create an SSF-enabled OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. receiver client, then configure its stream settings via the Admin Console.
    📍In the Admin Console: 1. Open the target realm → Settings → SSF Transmitter toggle → On (sets ssf.transmitterEnabled). 2. Go to Clients → Create client, set Client authentication On, Service accounts roles enabled. 3. On the client's SSF tab: enable SSF, set Default Subjects to ALL, add an Audience (e.g. https://caep.dev), and tick Push and Poll as supported delivery methods. 4. Under Client scopes, add ssf.read and ssf.manage as Optional scopes.
    • Adds experimental SSF 1.0 Transmitter role: Keycloak now pushes signed Security Event Tokens (SETs) to subscribed receivers for identity events such as session revocation, credential change, and account disable.
    • Supports CAEP 1.0 and RISC 1.0 event profiles, automatically mapping native Keycloak events (login, logout, credential change, session revocation) to the correct standardised event types.
    • Supports both HTTP push (RFC 8935) and HTTP poll (RFC 8936, return-immediately) delivery channels for SET distribution.
    • Introduces a transactional outbox: events are durably persisted in the same transaction that produced them, then drained asynchronously with exponential backoff, decoupling generation from delivery.
    • New synthetic event REST endpoint lets external tools (e.g. SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared./IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. platforms) inject events that did not originate inside Keycloak — useful for bridging external credential-change signals.

    +5 more show less

    • Configures SSF Receivers as standard OIDC clients with a per-client ssf.enabled toggle, ssf.read/ssf.manage scopes, and a defaultSubjects policy of ALL or NONE.
    • Adds per-receiver event filter (emit-only-events allowlist) so each receiver subscribes only to the event types it needs.
    • Ships legacy SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. CAEP draft profile for Apple Business Manager and Apple School Manager interoperability, enabling Keycloak to act as a federated IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. for Apple device fleets.
    • Exposes full stream CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. plus status, verification, and stream-config endpoints; streams and subjects are manageable via both the Admin REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. and new Admin Console SSF tabs.
    • Adds Prometheus metrics under the keycloak_ssf_* namespace covering dispatcher, drainer, poll endpoints, verification flow, outbox depth, and per-delivery counters and latencies.

    10 details in Everything

17. Experimental Shared Signals Framework support (2026-07-03) Jul 3, 2026 · issue 002

    Keycloak gains experimental OpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. Shared Signals Framework (SSF) 1.0 Transmitter support, pushing signed SETs to receivers in seconds.

    └──▷ TRY IT
    Enable the experimental SSF Transmitter feature when starting Keycloak so the per-realm SSF endpoints become available.
    copy

    $ kc.sh start-dev --feature-ssf=enabled

    Obtain a client-credentials token scoped to SSF management, then use it to create or manage streams against the Keycloak SSF transmitter endpoints.
    copy

    $ curl -s -X POST "https://my.keycloak.test/realms/myrealm/protocol/openid-connect/token" \
      -d "grant_type=client_credentials" \
      -d "client_id=caep-receiver" \
      -d "client_secret=…" \
      -d "scope=ssf.read ssf.manage"

    Enable the SSF Transmitter for a realm and create an SSF-enabled OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. receiver client, then configure its stream settings via the Admin Console.
    📍In the Admin Console: 1. Open the target realm → Settings → SSF Transmitter toggle → On (sets ssf.transmitterEnabled). 2. Go to Clients → Create client, set Client authentication On, Service accounts roles enabled. 3. On the client's SSF tab: enable SSF, set Default Subjects to ALL, add an Audience (e.g. https://caep.dev), and tick Push and Poll as supported delivery methods. 4. Under Client scopes, add ssf.read and ssf.manage as Optional scopes.
    • Adds experimental SSF 1.0 Transmitter role: Keycloak now pushes signed Security Event Tokens (SETs) to subscribed receivers for identity events such as session revocation, credential change, and account disable.
    • Supports CAEP 1.0 and RISC 1.0 event profiles, automatically mapping native Keycloak events (login, logout, credential change, session revocation) to the correct standardised event types.
    • Supports both HTTP push (RFC 8935) and HTTP poll (RFC 8936, return-immediately) delivery channels for SET distribution.
    • Introduces a transactional outbox: events are durably persisted in the same transaction that produced them, then drained asynchronously with exponential backoff, decoupling generation from delivery.
    • New synthetic event REST endpoint lets external tools (e.g. SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared./IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. platforms) inject events that did not originate inside Keycloak — useful for bridging external credential-change signals.

    +5 more show less

    • Configures SSF Receivers as standard OIDC clients with a per-client ssf.enabled toggle, ssf.read/ssf.manage scopes, and a defaultSubjects policy of ALL or NONE.
    • Adds per-receiver event filter (emit-only-events allowlist) so each receiver subscribes only to the event types it needs.
    • Ships legacy SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. CAEP draft profile for Apple Business Manager and Apple School Manager interoperability, enabling Keycloak to act as a federated IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. for Apple device fleets.
    • Exposes full stream CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. plus status, verification, and stream-config endpoints; streams and subjects are manageable via both the Admin REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. and new Admin Console SSF tabs.
    • Adds Prometheus metrics under the keycloak_ssf_* namespace covering dispatcher, drainer, poll endpoints, verification flow, outbox depth, and per-delivery counters and latencies.

    10 details in Everything

18. Keycloak 26.6.3 released (2026-06-04) Jun 4, 2026 · release notes

    Keycloak 26.6.3 adds DB startup checks, FD_SOCK2 SPISPISerial Peripheral Interface, a synchronous communication bus standard used to connect microcontrollers to sensors, flash memory, and other peripherals at short range; cyber tools use it to read or write firmware on embedded devices., and SQL Server collation fix.

    • Adds startup check for missing database indexes to detect schema drift before boot
    • Adds SPI option to disable FD_SOCK2 failure detection for advanced cluster tuning

    2 details in Everything

19. 26.6.0 Nov 25, 2025 · release notes

    Keycloak 26.6.0 adds Workflows (YAML automation), JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. Auth Grant, Federated Client Auth, Org Groups, Vault SPISPISerial Peripheral Interface, a synchronous communication bus standard used to connect microcontrollers to sensors, flash memory, and other peripherals at short range; cyber tools use it to read or write firmware on embedded devices. secrets lookup, and zero-downtime defaults.

    • Adds workflows subsystem allowing administrators to automate realm tasks using YAML-defined logic triggered by events, conditions, or schedules
    • Promotes JWT Authorization Grant (RFC 7523RFC 7523An IETF standard that defines how a JSON Web Token (JWT) can be used as a credential to request an OAuth 2.0 access token, letting a cyber tool authenticate to an API without exchanging a username and password at runtime.) to supported status, enabling external-to-internal token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. via externally signed JWT assertions
    • Promotes Federated client authentication to supported status for clients leveraging existing credentials from trusted issuers, including Kubernetes Service Accounts and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. providers
    • Adds Organization groups feature supporting isolated group hierarchies per organization with Identity Provider mappers for automated assignment based on external claims
    • Adds new FGAP scope manage-membership-of-members to enable user-side bridge evaluation for group membership permissions based on current user memberships

    +5 more show less

    • Enables secrets lookup for clients via the Vault SPI, allowing management and retrieval of client secrets through the standard SPI interface
    • Adds optional Enable LDAP password policy setting in LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. advanced settings to prompt LDAP users to update passwords when the backend indicates a mandatory change
    • Promotes Zero-downtime patch releases to supported status and enables them by default for rolling updates within the same major.minor release stream
    • Adds new CLI options for database configuration including TLS setup, connection timeouts, transaction timeouts with production defaults, and UTF-8 encoding verification at startup
    • Enables graceful shutdown of the HTTP stack to prevent error responses during rolling updates or configuration changes

    10 details in Everything

20. 26.4.0 Jun 18, 2025 · release notes

    Keycloak 26.4.0 adds PasskeysPasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices., DPoPDPoPAn IETF standard that binds an OAuth access token to a specific client's cryptographic key pair, so a stolen token cannot be replayed by an attacker who lacks the matching private key. support, FAPI 2 compliance, Federated Client Auth preview, and automated SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. cert management.

    • Adds fapi-2-dpop-security-profile and fapi-2-dpop-message-signing client profiles for FAPI 2 compliance
    • Enables Passkeys authentication via the Authentication > Policies > Webauthn Passwordless Policy UI toggle
    • Adds support for OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. DPoP tokens on Admin REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. and Account REST API endpoints
    • Allows public clients to bind only refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. to DPoP, omitting access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. binding
    • Supports requiring the dpop_jkt parameter in OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authentication requests

    +3 more show less

    • Adds Federated Client Authentication preview for SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. SVIDs and Kubernetes service account tokens
    • Automates SAML client certificate rotation via the Metadata descriptor URL setting in Signature and Encryption section
    • Exposes OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 Authorization Server Metadata via well-known URI compliant with RFC 8414 for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. integration

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !None explicitly documented as breaking; multi-site terminology updated to multi-cluster
21. 17.0.0 Jun 1, 2022 · release notes

    Keycloak 17.0.0 introduces Quarkus distribution, JAVA_OPTS_APPEND, glob-like user search, and lazy offline sessions.

    └──▷ TRY IT
    Pass custom JVMJVMThe Java Virtual Machine, a runtime maintained by Oracle (and implemented by others) that executes Java bytecode on any OS, giving cyber tools a portable, garbage-collected environment with a large ecosystem of libraries. flags like heap size or debugging options via environment variable.
    copy

    $ JAVA_OPTS_APPEND="-Xmx2g -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005" ./kc.sh start

    Search for users with usernames starting with admin or containing user in the Admin Console UI.
    📍Use prefix search admin* or infix search *user* in the User Search field in the Admin Console
    • Adds JAVA_OPTS_APPEND environment variable to pass custom Java options in the new Quarkus distribution
    • Supports glob-like syntax (prefix, infix, exact) for User Search in the Admin Console
    • Loads offline sessions lazily by default instead of preloading at startup

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !h2-mem and h2-file database types are renamed to dev-mem and dev-file