The primary objective is to address the current absence of a Keycloak extension that supports webhook calls from individual Keycloak clients. Typically, webhook configurations are set up at the realm level, resulting in their application to all clients within that realm.

Keycloak PoW Extension — adds computational PoW (proof-of-work) challenges to login, registration, and password-reset flows. Protects against bot spam and brute-force attacks by requiring clients to solve a light cryptographic puzzle before authenticating. Uses Argon2 (memory-hard, GPU-resistant) or SHA-256, with IP-adaptive difficulty that scales challenge hardness based on per-IP request patterns. Rate state is stored in Infinispan, enabling shared difficulty tracking across clustered Keycloak instances. Deploy as a standard Keycloak SPI plugin — works with any Keycloak 26.6 instance. Three-layer defense on every submission: 1. Honeypot — silently rejects bots that auto-fill all form fields 2. Solve-time validation — rejects submissions arriving faster than configured minimum (default 500ms) 3. Hash verification — verifies proof-of-work correctness and prevents nonce replay attacks