Repository navigation
Add extension: Keycloak API Keys #847
Description
Description
Please add the following community extension to the extensions page:
{
"name": "Keycloak API Keys",
"description": "Self-service and admin-managed API keys for Keycloak. Users create client-scoped API keys in the Account Console and exchange them for JWT access tokens.",
"website": "https://github.com/emdzej/keycloak-api-keys"
}- Source: https://github.com/emdzej/keycloak-api-keys
- Documentation: https://emdzej.github.io/keycloak-api-keys/
- License: Apache-2.0
- Built against Keycloak 26.8.2
- SPI published on Maven Central (
pl.emdzej.keycloak:keycloak-api-keys-spi), middleware on npm (@emdzej/keycloak-api-keys-*) and NuGet (EmDzej.KeycloakApiKeyAuthentication)
Discussion
No response
Motivation
Keycloak has no built-in API key support. Services that need long-lived credentials for scripts, CI, or machine-to-machine access usually fall back to service-account clients with shared secrets, which end users can't manage themselves. This extension lets users generate, list and revoke their own scoped API keys and exchange them for standard Keycloak JWTs, so the resource servers that already validate Keycloak tokens don't need to change.
Details
Components:
- Keycloak SPI: key storage, REST API, API key → JWT token exchange
- Account Console extension for user self-service
- Admin Console extension for administrators
- Integration libraries: Spring MVC, Spring WebFlux, Express, Fastify, Hono, ASP.NET Core
Happy to open the PR adding extensions/keycloak-api-keys.json if that's preferred.
Activity