Keycloak Config Generator

Keycloak Realm Best Practices

One Realm Per Tenant: For multi-tenant SaaS, consider separate realms or use Keycloak organizations
Meaningful Names: Use lowercase, hyphenated names (e.g., my-app-prod)
Session Timeouts: Balance security (shorter) vs UX (longer). 30min idle, 10hr max is common
Email Verification: Enable for production to ensure valid user emails

Public: For SPAs, mobile apps, and native apps where the client secret cannot be safely stored
Confidential: For server-side applications that can securely store a client secret
Bearer Only: For APIs that only validate tokens and never initiate login flows

Most modern web apps use a Public client with PKCE for the frontend and a Confidential client for the backend API.

Realm Roles are global to the realm and can be assigned to any user. Common examples: admin, user, moderator.

Client Roles are scoped to a specific client application. Useful for application-specific permissions like billing:read, billing:write.

Composite Roles can contain other roles. Example: super-admin includes both admin and billing-admin.

Via Admin Console: Master realm > Create Realm > Browse > Select JSON file

Via Docker:

docker run -v ./realm.json:/opt/keycloak/data/import/realm.json \
  quay.io/keycloak/keycloak start-dev \
  --import-realm

Via Kubernetes: Mount the realm JSON as a ConfigMap and use the import flag.