Admin Console Tour

The admin console is your control centre for Keycloak. Every realm, client, user, role, and identity provider is created and managed here. Before you create anything, it is worth spending a few minutes understanding the layout so you do not get lost.

Signing in

Make sure Keycloak is running (see the previous lesson if you have not started it yet).
Open http://localhost:8080 in your browser.
Click “Administration Console”.
Enter admin as the username and admin as the password.
Click “Sign in”. You land on the master realm’s home page.

The realm selector

The top-left of the admin console shows the current realm name — by default “Keycloak” (the master realm). Click it to open a drop-down that lists all your realms and lets you create a new one. Always check which realm you are in before making changes — it is easy to accidentally create a client in the wrong realm.

The sidebar gives you access to every resource in the current realm:

Nav item	What you manage here
Realm settings	Token lifespans, security defences, email settings, themes
Clients	Applications registered to use this realm for auth
Client scopes	Shared protocol mappers and scope definitions
Realm roles	Roles available to all clients in this realm
Users	User accounts, credentials, and role assignments
Groups	User groups and group-level role assignments
Identity providers	External IdPs (Google, GitHub, SAML, OIDC)
User federation	LDAP and Active Directory connections
Sessions	Active user sessions across all clients
Events	Audit log of login events and admin events

Creating your first realm (warm-up)

Click the realm selector (top-left).
Click “Create realm”.
In the “Realm name” field, enter my-app (lowercase, no spaces).
Leave “Enabled” toggled on.
Click “Create”.
You are now inside the my-app realm. The top-left selector now shows “my-app”.

Trade-offs

Option	Benefit	Cost
Manage via the admin console (manual)	Immediate feedback, good for learning and one-off setup, no code required	Hard to repeat, no version-controlled audit trail, more prone to human error as the team grows
Manage via REST API / Terraform provider	Configuration as code, reviewable through a pull request, fast to reproduce a new environment	Requires writing and maintaining scripts/Terraform state, with a steeper initial learning curve

Common mistakes

Not changing the default admin credentials (admin/admin) — this default is meant only for bootstrap. Change the password or create a new admin user and disable the default one before going live.
Creating real application clients in the master realm — master should be reserved for administering Keycloak itself; mixing in real application clients unnecessarily widens the blast radius around the admin account.
Forgetting to check the realm selector before creating a resource — accidentally creating a user, client, or role in the wrong realm is very common, especially when switching between several realms in one day.

Real-world example

A platform team managing many apps — commonly creates a separate realm per business unit or per environment (dev/staging/prod), then uses the Keycloak Terraform provider to provision clients and roles reproducibly instead of clicking through the admin console every time.

An organisation that has been through a security audit — often enforces a policy that the master realm’s admin account must have MFA enabled and restricts access to the platform/security team only, with no general developer holding admin rights in the master realm.

Admin Console Tour

Signing in

The realm selector

The left navigation

Creating your first realm (warm-up)

Trade-offs

Common mistakes