Keycloak — From Zero to Hero

A standalone, beginner→advanced course on Keycloak. Self-host it in seconds with the gifted Docker command below, then learn realms, OIDC flows, securing apps, and production hands-on.

Start here Jump to Realms & Clients

🔐 Run Keycloak with Docker first

Start Keycloak in dev mode:

docker run --name keycloak -p 8080:8080 \
  -e KC_BOOTSTRAP_ADMIN_USERNAME=admin \
  -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin \
  quay.io/keycloak/keycloak:latest start-dev

Then open http://localhost:8080 and sign in to the admin console with admin / admin.

start-dev uses an in-memory database — perfect for learning. Use a real database and start for production.

What you’ll learn

Intro & Setup

What Keycloak is, the gifted Docker command, the admin console, dev vs production. Start →

Realms, Clients & Roles

Realms, clients (public/confidential), realm vs client roles, composites. Learn →

Users, Groups & Credentials

Users, groups & role mappings, passwords/OTP, required actions. Manage →

OIDC & OAuth2 Flows

OIDC vs OAuth2, Authorization Code + PKCE, client credentials, token endpoint. Flow →

Securing Apps

A SPA with keycloak-js, a backend validating JWTs, refresh & logout, adapters. Secure →

Tokens, Scopes & Mappers

Access/ID/refresh tokens, client scopes, protocol mappers, lifespans. Tokens →

Identity Federation & Social Login

Social login, identity brokering, LDAP/AD federation, IdP mappers. Federate →

Admin, Theming & Production

Admin REST API, themes, events & audit, the production checklist. Ship →

How this course works

Gifted setup

One copy-paste docker run starts Keycloak in dev mode — you’re in the admin console before the first lesson.

Copy-ready snippets

Every curl, config, and SDK example has a one-click copy to paste into your project.

Quizzes & progress

Check your understanding after each lesson; your progress is saved locally.

Bilingual

Available in English and ไทย — switch anytime from the top bar.