---
layout: integration
title: OAuth with Keycloak
description: Sign users in through a realm on your Keycloak server
date: 2026-11-06
featured: false
isPartner: true
isNew: true
cover: /images/integrations/oauth-keycloak/cover.avif
category: auth
product:
    vendor: Keycloak
    description: 'Keycloak is an open source identity and access management server that supports OpenID Connect, OAuth 2.0, and SAML.'
platform:
    - 'Self-hosted'
    - 'Cloud'
---

[Keycloak](https://www.keycloak.org/) is an open source identity and access management server, maintained as a Cloud Native Computing Foundation project. Organizations run it to provide single sign-on over OpenID Connect, OAuth 2.0, and SAML, with users, roles, and identity brokering managed per realm.

# How does the integration work?

You can use the Keycloak OAuth adapter in Appwrite Auth to sign users in through a realm on your Keycloak server. Appwrite redirects users to the realm's OpenID Connect endpoints, exchanges the authorization code for tokens, and creates an Appwrite user from the user info Keycloak returns. Users keep their identity, policies, and federated logins in Keycloak, and your app gets Appwrite sessions and APIs on top of it.

Appwrite requests the `openid`, `profile`, and `email` scopes, plus `offline_access` for a refresh token. It marks the user's email as verified only when Keycloak returns `email_verified` as `true`.

# Prerequisites

- A Keycloak server served over HTTPS. Appwrite calls the realm's token and user info endpoints from the server, so it must be reachable from your Appwrite project.
- Admin access to the realm your users sign in to.

# How to implement

To implement the Keycloak OAuth adapter in Appwrite Auth, there are several steps you must complete:

## Step 1: Create a client in your Keycloak realm

In the Keycloak admin console, select the realm your users belong to, open **Clients**, and click **Create client**.

Configure the client:

- **Client type**: OpenID Connect.
- **Client ID**: a name such as `appwrite`. This is the value you'll enter in Appwrite.
- **Client authentication**: turn it on, so Keycloak issues a client secret for the client.
- **Standard flow**: keep it enabled. Appwrite uses the authorization code flow.

You'll fill in **Valid redirect URIs** after you configure Appwrite in the next step. Save the client, then open its **Credentials** tab and copy the **Client Secret**.

## Step 2: Add Keycloak OAuth adapter to your Appwrite project

For this step, you must [create an account on Appwrite Cloud](/sign-up) or [self-host Appwrite](/docs/advanced/self-hosting) if you haven't already. In your Appwrite project, head over to the **Auth** page, open the **Settings** tab, and click **Keycloak** under the **OAuth2 Providers** section.

Fill in the provider form:

- **Client ID**: the client ID you chose in Keycloak.
- **Client Secret**: the secret from the client's **Credentials** tab.
- **Domain**: the host name of your Keycloak server without `https://`, for example `keycloak.example.com`.
- **Realm name**: the name of the realm, for example `appwrite-realm`.

Appwrite builds the realm's endpoints as `https://<DOMAIN>/realms/<REALM>`, so the sign-in page lives at `https://keycloak.example.com/realms/appwrite-realm/protocol/openid-connect/auth`. Turn the provider on and click **Update**. Appwrite won't enable the provider until both **Domain** and **Realm name** are set.

Copy the **Redirect URI** shown in the form. On Appwrite Cloud it looks like `https://<REGION>.cloud.appwrite.io/v1/account/sessions/oauth2/callback/keycloak/<PROJECT_ID>`, but always copy the exact value from the Console. In Keycloak, open the client's settings and add it to **Valid redirect URIs**, then save.

## Step 3: Test the provider

Start a session from your app with the `OAuthProvider.Keycloak` value. With the Web SDK:

```js
import { Client, Account, OAuthProvider } from 'appwrite';

const client = new Client()
    .setEndpoint('https://<REGION>.cloud.appwrite.io/v1')
    .setProject('<PROJECT_ID>');

const account = new Account(client);

account.createOAuth2Session({
    provider: OAuthProvider.Keycloak,
    success: 'https://example.com/success',
    failure: 'https://example.com/failed',
});
```

Add your app's domain as a web platform in your Appwrite project so Appwrite accepts the `success` and `failure` URLs. Follow the [OAuth 2 login](/docs/products/auth/oauth2#init) flow for other platforms and for server-side sign-in.

# Read more about Keycloak and Appwrite Auth

If you would like to learn more about Keycloak and Appwrite Auth, we have some resources that you should visit:

- [Keycloak server administration guide](https://www.keycloak.org/docs/latest/server_admin/)
- [Implement OAuth login in your apps using Appwrite Auth](/docs/products/auth/oauth2)
- [Link multiple sign-in methods with identities](/docs/products/auth/identities)
- [Understanding OAuth and OpenID Connect](/blog/post/oauth-openid)
- [Appwrite Auth API reference](/docs/references/cloud/client-web/account)