What Keycloak does
Keycloak is open-source identity and access management for applications and services.
Why teams reach for it: Adds authentication to applications and secures services with minimum effort, without requiring applications to store or authenticate users.
Worth knowing
It implements OAuth 2.1, with PKCE supported, and CIMD and DCR client registration. It federates with OpenID Connect identity providers and holds an upstream token vault for third-party credentials and is self-hostable.
How Keycloak compares
Fields the vendor doesn't document are left blank here rather than guessed — a blank means nothing verified, not a "no."
- Oauth Version
- OAuth 2.1
- Client Registration
- CIMD and DCR
- Resource Indicators (RFC 8707)
- No
- Protected Resource Metadata (RFC 9728)
- No
- Authorization Server Metadata (RFC 8414)
- Yes
- Pkce
- Supported
- Token Exchange (RFC 8693)
- Yes
- Agent Delegation
- Carried in token
- Idp Federation
- OpenID Connect identity providers
- Upstream Token Vault
- Yes
- Self Hostable
- Yes
- Audit Log
- Yes
Who can connect, and what may they do?
Authorization & identity tools control who — or which AI agent — is allowed to connect, and what they're allowed to do once connected.