---
title: "Deploy Keycloak on StackBlaze"
description: "Deploy Keycloak in production mode with managed PostgreSQL, email that sends, and a public HTTPS URL. The admin account is created at the first start with a generated password, so the server is never left open for someone else to claim. Add a realm, register your apps as OpenID Connect or SAML clients, and your users sign in once."
category: "security, development, work"
url: https://www.stackblaze.com/templates/keycloak
---

# Deploy Keycloak

Deploy Keycloak in production mode with managed PostgreSQL, email that sends, and a public HTTPS URL. The admin account is created at the first start with a generated password, so the server is never left open for someone else to claim. Add a realm, register your apps as OpenID Connect or SAML clients, and your users sign in once.

**[Deploy Keycloak on StackBlaze](https://dashboard.stackblaze.com/new/template/keycloak)**

## This stack

- **Keycloak**: Web service
- **PostgreSQL**: managed database · TCP:5432
- **Email**: platform add-on

## What you get

- **OpenID Connect and SAML**: Register web apps, APIs, mobile apps and SAML service providers as clients. Authorization code with PKCE, client credentials and token exchange are built in.
- **Users, groups and roles**: Manage people in the admin console, put them in groups and give groups realm or client roles. Your apps read the roles straight from the token.
- **Federation and social login**: Connect an existing LDAP or Active Directory, or let people sign in with another identity provider over OpenID Connect or SAML.
- **Multi-factor and passkeys**: Turn on one-time codes or WebAuthn passkeys per realm, set password policies and brute force protection, and shape the login flow step by step.
- **Realms for each audience**: Keep customers, staff and partners apart in separate realms, each with its own users, login page, themes, languages and email settings.
- **Self-service account console**: Users update their profile, change their password, set up two-factor sign-in and sign out other devices on their own account page.

## After you deploy

1. **Sign in to the admin console**: Open your app URL, choose the Administration Console and sign in as admin with ADMIN_PASSWORD from the app’s Variables. Then change the password on the admin user’s Credentials tab.
2. **Create a realm**: Keep the master realm for administrators. Create a realm for your own users, then add users or connect your LDAP or Active Directory.
3. **Connect your apps**: Add each app as a client and point its OpenID Connect library at your realm’s discovery URL, /realms/<realm>/.well-known/openid-configuration on your app URL.

## How it is wired

- **PostgreSQL holds everything**: Realms, users, clients, credentials, sessions and events live in the attached PostgreSQL database, with passwords generated at deploy. Signed-in users stay signed in across redeploys.
- **Claimed at the first start**: The start command turns Keycloak’s temporary bootstrap admin into a permanent admin account with your generated password, then removes the temporary one.
- **Mail goes through the Email add-on**: Password reset, email verification and admin action emails send through the platform relay. Realms without their own mail server get it on each start.
- **Health stays private**: Health checks and metrics answer only on the internal management port, never through your public URL, as the Keycloak docs recommend.

## Common questions

### How do I sign in the first time?

Open your app URL, go to the Administration Console and sign in as admin with ADMIN_PASSWORD from the app’s Variables in the dashboard. Change the password afterwards on the admin user’s Credentials tab.

### Is this production mode or development mode?

Production mode. Keycloak starts with kc.sh start, uses PostgreSQL, trusts the forwarded headers set by the StackBlaze edge and builds its URLs from your app URL.

### Does email work for password resets?

Yes. Each realm has its own email settings, and the template fills them with the platform Email add-on for every realm that has none, on each start. Point a realm at your own SMTP server under Realm settings, Email if you prefer, and it is left alone.

### Can I add custom themes or extensions?

The template runs the official Keycloak image. Custom themes and provider JARs belong in your own image built from it, deployed on StackBlaze like any Docker image.

### Can I run more than one instance?

The template runs one instance with a local cache. Sessions are stored in PostgreSQL, so a restart or redeploy does not sign anyone out.

### Can I use my own domain?

Yes. Attach a custom domain from the dashboard, for example auth.example.com, and set KC_HOSTNAME to the new https address so tokens and links carry it.

### What does it cost?

You pay for the compute, storage and bandwidth Keycloak and PostgreSQL use, and for the emails it sends, not per user.


Source: https://github.com/keycloak/keycloak