Backups

Skycloak backs up your cluster’s database every day, keeps each backup for your plan’s retention, and lets you take an extra backup whenever you need one, for example before a risky configuration change. Backups stay in the same region as your cluster.

Open a cluster and choose Backups in the sidebar.

What you see

The summary at the top shows:

• Latest restore point: how long ago your newest completed backup was taken, with Healthy or Last run failed.
• Next automatic backup: when the next daily backup starts. Change sets the daily backup time.
• Retention: how long daily backups are kept, and the longest you can keep a Backup now.
• Storage used: the total size of the stored backups, and how many restore points you have.
• Last 30 days: one square per day, green when that day was backed up (even if that backup has since expired), red when its backup failed, grey when there was none. Days before your first backup, and today until its backup has run, are left pale and are not counted.

Below it, Restore points lists your backups grouped by day (in UTC), newest first. Filter it by Automatic, Manual or Failed. Expired backups, and failed runs older than your plan’s retention, are kept for your records under Expired.

Each row’s ⋯ menu copies the backup ID or its SHA-256 checksum. One-click restore from the dashboard is coming soon; until then, you can restore a backup into a new cluster.

Retention

A backup is deleted automatically when it expires. Deleting a cluster deletes all of its backups straight away, with no grace period, so download anything you want to keep first.

Daily backup time

By default the daily backup starts at the beginning of your cluster’s maintenance window. To pick your own time, click Change under Next automatic backup, set Daily backup time (UTC) and click Save time. The page also shows the time in your own time zone. Use maintenance window switches back to the default.

Backups run while your cluster keeps serving sign-ins; your users are not affected.

Backup now

Click Backup now, choose how long to keep the backup, and click Start backup. It appears in the list as Manual. Only one backup of a cluster runs at a time, so Backup now is unavailable while another backup is queued or running.

Downloading a backup

Click the download icon next to a completed backup. A backup is a complete copy of the cluster’s database, including every user and their credentials (password hashes, OTP secrets, client secrets), so you have to tick Include credentials to confirm before the download starts.

• The download link works once and expires after 15 minutes. Ask for a new one if you need it again.
• The file is a PostgreSQL custom-format archive (.dump). To restore it on Skycloak, see Restoring a backup. To load it into your own PostgreSQL, restore it into an empty database with pg_restore from a PostgreSQL 17 or newer client, and run Keycloak at the same version or newer against it. You then run and secure that database yourself:

pg_restore --no-owner --no-acl --dbname "$DATABASE_URL" my-cluster-auto-202609230300.dump

• Every download is recorded in your audit log as Backup Downloaded.

Store downloaded backups as securely as the cluster itself.

Restoring a backup

One-click restore into an existing cluster is coming soon. Today you can restore a backup into a new cluster:

1. Download the backup.
2. Click Restore to a new cluster on the Backups page, or Migrate from Keycloak on the Clusters page.
3. In the Source database step, upload the .dump file as it is. There is no need to unzip, convert or encrypt it.
4. Pick the Keycloak version the backup was taken on (the Keycloak column) or a newer one, then finish the wizard. Never pick an older version: Keycloak cannot start on a database from a newer release.

The new cluster starts with the backup’s realms, users, clients and settings. The original cluster is not changed. The new cluster counts toward your plan’s cluster limit, so free a slot or add one first if you are at it.

A backup holds the database only. Bring the rest across in the wizard:

• Custom themes and extensions are not in the backup. Upload them in the wizard’s Branding & themes and Extensions steps, or realms that use a custom theme or authenticator will not work.
• Custom domains are not moved. If a realm’s Frontend URL points at the original cluster’s custom domain, the new cluster keeps sending users there. After the restore, clear it in the Keycloak admin console under Realm settings > General > Frontend URL. To move the domain itself, remove it from the original cluster first, then add it to the new one on its Custom domain page.

To load a backup into your own PostgreSQL instead, use pg_restore as shown in Downloading a backup.

When a backup fails

A backup that still fails after several automatic retries is marked Failed, including a daily backup that could not start in its time slot. When that happens:

• every member of the workspace gets an email (members can turn these off under Cluster changes in their notification settings);
• the cluster page shows a Backup failed badge next to the cluster status, linking to the Backups page;
• a backup.failed webhook is sent, if you subscribe to it.

Your earlier backups stay available until they expire, and the next daily backup runs as planned. You can also start one right away with Backup now.

Webhooks

Subscribe a webhook with the Platform source to the Backup events:

The event’s data object:

{
  "backup_id": "auto-202609230300",
  "type": "automatic",
  "status": "completed",
  "retention_days": 14,
  "requested_at": "2026-09-23T03:00:00Z",
  "completed_at": "2026-09-23T03:04:12Z",
  "size_bytes": 52428800,
  "sha256": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
  "expires_at": "2026-10-07T03:04:12Z"
}

backup.failed carries failure_reason and attempts instead of size_bytes, sha256 and expires_at:

Automating backups

Everything on the Backups page is also available through the public API.

Backups and Database Export

Database Export is a separate, manual flow and works exactly as before. Exports never appear in the Backups list, and backups do not count against exports.