Extensions

Sign in to Keycloak using another device with QR Codes

Keycloak Push-MFA Extension

Keycloak Vault SPI provider for OpenBao and HashiCorp Vault

Keycloak X509 client certificate lookup SPI implementation for Envoy

Keycloak social login provider for TikTok

Custom OIDC and SAML Protocol Mapper for Keycloak 26.x that enriches federated users with attributes fetched from external REST APIs at token issuance time.

The primary objective is to address the current absence of a Keycloak extension that supports webhook calls from individual Keycloak clients. Typically, webhook configurations are set up at the realm level, resulting in their application to all clients within that realm.

Keycloak extension to add HiOrg-Server as an identity provider

A Keycloak authenticator that enables login with an ID or Access token

Keycloak PoW Extension — adds computational PoW (proof-of-work) challenges to login, registration, and password-reset flows. Protects against bot spam and brute-force attacks by requiring clients to solve a light cryptographic puzzle before authenticating. Uses Argon2 (memory-hard, GPU-resistant) or SHA-256, with IP-adaptive difficulty that scales challenge hardness based on per-IP request patterns. Rate state is stored in Infinispan, enabling shared difficulty tracking across clustered Keycloak instances. Deploy as a standard Keycloak SPI plugin — works with any Keycloak 26.6 instance. Three-layer defense on every submission: 1. Honeypot — silently rejects bots that auto-fill all form fields 2. Solve-time validation — rejects submissions arriving faster than configured minimum (default 500ms) 3. Hash verification — verifies proof-of-work correctness and prevents nonce replay attacks