Insights on Identity, Security & Keycloak
Tutorials, deep dives, and best practices from the Skycloak team.
Keycloak Redirect URI Change: Fix HTTP Parameter Pollution
Keycloak 26.8 rejects redirect URIs that already carry state, code or session_state, a check that began in July. Why, what…
11 min read
Keycloak 26.8 OpenID4VP Verifier for EUDI Relying Parties
Keycloak 26.8.0 adds an experimental OpenID4VP verifier as an identity provider. What it supports, what it lacks, and a checklist…
14 min read
Keycloak 26.8 SCIM API: Supported and On by Default
Keycloak 26.8 makes the native SCIM API supported and on by default, but each realm still needs its own toggle.…
13 min read
Keycloak 26.8 Token Exchange Delegation for AI Agents
Keycloak 26.8 moves token exchange delegation to preview: users consent, FGAP V2 gates the agent, and the delegated token carries…
15 min read
Issuing Verifiable Credentials With Keycloak (OID4VCI)
How to issue Verifiable Credentials from Keycloak with OID4VCI: what the standard is, Keycloak's experimental support, and how it fits…
12 min read
Keycloak as an AuthZEN Policy Decision Point
Keycloak 26.7 added experimental AuthZEN support, so apps can ask Keycloak for permit or deny decisions over a standard API.…
9 min read
MCP Authorization Decision Tree: When to Use Keycloak
MCP authorization is optional and stdio servers should skip OAuth. A decision tree for when to use API keys, OAuth,…
9 min read
Non-Human Identity (NHI) for AI Agents on Keycloak
A non-human identity is an identity used by software, not a person. How AI agents fit, why one shared bot…
10 min read
CVE-2026-5430: WSO2 JWT Bypass and Your Keycloak APIs
CVE-2026-5430 let forged JWTs past WSO2 API Manager authentication. Here is how you pin algorithms and fail closed on APIs…
13 min read
Microsoft Entra Agent ID vs Keycloak for AI Agent Identity
Microsoft Entra Agent ID gives AI agents directory identities. Here is how blueprints, FIC and agent OBO map to Keycloak…
13 min read
Stay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.