Quick start

Option A — Manual install

1. 1

   Find an extension

   Browse the registry and open the extension you want. On the Versions tab, each release has a Download button and its SHA-256 digest for verification.

2. 2

   Drop the JAR in and build

   Place the downloaded JAR in /opt/keycloak/providers/ and run kc.sh build. That's it — no registry connection at runtime.

Option B — Docker integration

For containerised setups. The registry publishes a minimal OCI image for every extension version, so you can pull the JAR straight into your Dockerfile without downloading anything manually.

1. 1

   Find an extension

   Browse the registry. On each extension's Overview tab, the Install section shows the exact Dockerfile snippet to copy, with the correct image reference and version already filled in.

2. 2

   Paste into your Dockerfile

   Copy the snippet from the extension page and use it as your Dockerfile. To add more extensions, duplicate the COPY --from= line, one per extension, before the RUN kc.sh build step.

   FROM quay.io/keycloak/keycloak AS builder
   COPY --from=kcer.dev/providers/home-idp-discovery:v26.1.0 /providers/ /opt/keycloak/providers/
   RUN /opt/keycloak/bin/kc.sh build
   
   FROM quay.io/keycloak/keycloak
   COPY --from=builder /opt/keycloak/ /opt/keycloak/
   ENTRYPOINT ["/opt/keycloak/bin/kc.sh"]
   CMD ["start", "--optimized"]

   Copy
3. 3

   Build and run

   Run docker build .. Extensions are baked in at build time. Your running container has no dependency on the registry. To upgrade an extension, change the image tag in the COPY --from= line and rebuild.