Articles about definition and basics from the Skycloak team.
MCP clients get a 401 from Keycloak-protected servers because of a wrong aud claim. Here is the RFC 8707 cause,…
Cross-App Access (ID-JAG) lets your identity provider broker scoped API access for AI agents instead of per-app consent and refresh-token…
Keycloak's latest version is 26.7.0, released July 9, 2026. See the full version history, support policy, and how to upgrade…
The complete guide to Keycloak: open-source IAM for SSO, MFA, user federation, and RBAC. Architecture, features, version history, and when…
IdP vs SP explained: what each role does in SAML and OIDC, and how Keycloak plays both at once through…
A SAMLRequest is the Base64-encoded, deflate-compressed XML authentication request an SP sends to an IdP. Learn how to decode it…
SCIM (System for Cross-domain Identity Management) is the open standard for automated user provisioning. How it works, SCIM 2.0 endpoints,…
What a JWKS (JSON Web Key Set) is, every field explained (kty, kid, use, n, e), how Keycloak publishes keys…
Is Keycloak overkill for a startup? An honest look at flat pricing vs per-MAU fees, the real ops burden, and…
Is Keycloak right for your B2B SaaS? An honest decision guide on multi-tenancy, enterprise SSO, SCIM, flat pricing, and the…
Get tutorials, product updates, and Keycloak tips delivered to your inbox.