Keycloak logo

Deploy Keycloak

Single sign-on for every app you run

SecurityDevelopmentWorkKeycloak + PostgreSQL + Email

Deploy Keycloak in production mode with managed PostgreSQL, email that sends, and a public HTTPS URL. The admin account is created at the first start with a generated password, so the server is never left open for someone else to claim. Add a realm, register your apps as OpenID Connect or SAML clients, and your users sign in once.

What you get with Keycloak

  • OpenID Connect and SAMLRegister web apps, APIs, mobile apps and SAML service providers as clients. Authorization code with PKCE, client credentials and token exchange are built in.
  • Users, groups and rolesManage people in the admin console, put them in groups and give groups realm or client roles. Your apps read the roles straight from the token.
  • Federation and social loginConnect an existing LDAP or Active Directory, or let people sign in with another identity provider over OpenID Connect or SAML.
  • Multi-factor and passkeysTurn on one-time codes or WebAuthn passkeys per realm, set password policies and brute force protection, and shape the login flow step by step.
  • Realms for each audienceKeep customers, staff and partners apart in separate realms, each with its own users, login page, themes, languages and email settings.
  • Self-service account consoleUsers update their profile, change their password, set up two-factor sign-in and sign out other devices on their own account page.

After you deploy Keycloak

  1. 1Sign in to the admin consoleOpen your app URL, choose the Administration Console and sign in as admin with ADMIN_PASSWORD from the app’s Variables. Then change the password on the admin user’s Credentials tab.
  2. 2Create a realmKeep the master realm for administrators. Create a realm for your own users, then add users or connect your LDAP or Active Directory.
  3. 3Connect your appsAdd each app as a client and point its OpenID Connect library at your realm’s discovery URL, /realms/<realm>/.well-known/openid-configuration on your app URL.

How Keycloak is wired

Keycloak, PostgreSQL and the Email add-on ship together. Keycloak runs in production mode: TLS ends at the StackBlaze edge and every URL it issues uses your public HTTPS address.

PostgreSQL holds everything
Realms, users, clients, credentials, sessions and events live in the attached PostgreSQL database, with passwords generated at deploy. Signed-in users stay signed in across redeploys.
Claimed at the first start
The start command turns Keycloak’s temporary bootstrap admin into a permanent admin account with your generated password, then removes the temporary one.
Mail goes through the Email add-on
Password reset, email verification and admin action emails send through the platform relay. Realms without their own mail server get it on each start.
Health stays private
Health checks and metrics answer only on the internal management port, never through your public URL, as the Keycloak docs recommend.

Why run Keycloak on StackBlaze

  • Scale your appChange CPU, RAM, and replicas without a rebuild, or let autoscaling add replicas when CPU climbs.
  • Git-based CI/CDPush to GitHub and it builds and ships. Pull requests get their own preview URL on Pro and Business.
  • One-click rollbackA deploy went wrong? Go back to any previous successful deploy.
  • Environments built inProduction, staging, and dev as separate environments in one project, each with its own URL.
  • Built-in observabilityCPU, memory, and response time per app, live logs with search, and alerts to Slack, Discord, or a webhook.
  • Developer-first toolsA CLI and Stack MCP: deploy, read logs, and wire services from your terminal or your AI assistant.
  • Built for teamsInvite teammates with roles. An audit log records who changed what.
  • Managed Postgres with HAPostgres is run for you. Turn on high availability for a three-node cluster when the app needs it.

Common questions about Keycloak

How do I sign in the first time?

Open your app URL, go to the Administration Console and sign in as admin with ADMIN_PASSWORD from the app’s Variables in the dashboard. Change the password afterwards on the admin user’s Credentials tab.

Is this production mode or development mode?

Production mode. Keycloak starts with kc.sh start, uses PostgreSQL, trusts the forwarded headers set by the StackBlaze edge and builds its URLs from your app URL.

Does email work for password resets?

Yes. Each realm has its own email settings, and the template fills them with the platform Email add-on for every realm that has none, on each start. Point a realm at your own SMTP server under Realm settings, Email if you prefer, and it is left alone.

Can I add custom themes or extensions?

The template runs the official Keycloak image. Custom themes and provider JARs belong in your own image built from it, deployed on StackBlaze like any Docker image.

Can I run more than one instance?

The template runs one instance with a local cache. Sessions are stored in PostgreSQL, so a restart or redeploy does not sign anyone out.

Can I use my own domain?

Yes. Attach a custom domain from the dashboard, for example auth.example.com, and set KC_HOSTNAME to the new https address so tokens and links carry it. Custom domains

What does it cost?

You pay for the compute, storage and bandwidth Keycloak and PostgreSQL use, and for the emails it sends, not per user. Pricing

More Security templates

Browse all templates