Credentials & OTP

The Credentials tab

Every user in Keycloak has a Credentials tab on their profile page. This is where you manage the authentication secrets tied to that account. Keycloak supports several credential types:

• Password — the most common credential. Can be set as permanent or temporary.
• OTP (One-Time Password) — a time-based (TOTP) or counter-based (HOTP) second factor, typically used with an authenticator app such as Google Authenticator or Authy.

Administrators can set or reset credentials on behalf of users, and can also require users to set up credentials themselves on next login.

Setting and resetting a password

1. In the admin console, click Users in the left sidebar.
2. Search for and open the user whose password you want to set or reset.
3. Click the Credentials tab.
4. Click Set password.
5. Enter the new password in the Password field and confirm it in Password confirmation.
6. Toggle the Temporary switch to On if you want the user to be forced to choose a new password the next time they log in. Leave it Off to set the password as permanent.
7. Click Save password to confirm.

The Temporary flag is the key distinction: when set to On, Keycloak marks the credential as requiring an update. The next time the user logs in, they are redirected to a “Please update your password” page before being allowed into the application. This is the correct pattern for admin-initiated password resets — the administrator never needs to know the user’s permanent password.

Resetting a password via the REST API

curl -s -X PUT -H "Authorization: Bearer ${TOKEN}" -H "Content-Type: application/json" -d '{"type":"password","value":"TempPass123!","temporary":true}' http://localhost:8080/admin/realms/my-app/users/${USER_ID}/reset-password

Copy curl ⧉

Replace TOKEN with a valid admin access token and USER_ID with the UUID of the user (visible in the URL when you open a user in the admin console). Set "temporary": false if you want the password to be permanent.

🔐 Temporary passwords

Mark a reset password as “Temporary” to force the user to change it on next login — never leave a known reset password as permanent. A permanent reset password that the administrator set is a credential the administrator knows, which is a security risk.

Configuring OTP / 2FA

Keycloak supports two-factor authentication through OTP. The OTP settings for a realm are configured globally in the admin console, and individual users enroll their own authenticator devices through the Account Console.

Configuring OTP policy for the realm

1. Click Realm settings in the left sidebar.
2. Click the Authentication tab in the top navigation.
3. Click the OTP policy tab.
4. Review and adjust the following settings:
   • OTP type — choose Time Based (TOTP) (recommended; works with Google Authenticator, Authy, and most authenticator apps) or Counter Based (HOTP).
   • OTP hash algorithm — SHA1 is the default and is supported by virtually all authenticator apps. SHA256 and SHA512 offer stronger hashing but require app support.
   • Number of digits — 6 is standard; some apps support 8.
   • OTP token period — for TOTP, this is the number of seconds each code is valid (default: 30).
   • Look-ahead window — the number of intervals Keycloak tolerates for clock drift between the server and the user’s device.
5. Click Save.

How a user enrolls an OTP device

Users enroll their own OTP devices through the Keycloak Account Console:

1. Navigate to the Account Console URL for your realm: http://localhost:8080/realms/my-app/account/
2. Sign in with the user’s credentials.
3. Click Security in the left menu.
4. Click Two-factor authentication (or Signing in, depending on the Keycloak version).
5. Under Two-factor authenticators, click Set up authenticator application.
6. Scan the displayed QR code with an authenticator app (Google Authenticator, Authy, Microsoft Authenticator, etc.).
7. Enter the 6-digit code shown in the app to confirm the device, then click Submit.

The device is now enrolled. From the next login onwards, Keycloak will prompt for an OTP code after the password step when OTP is required in the authentication flow.

Password policy

Keycloak lets you enforce password rules at the realm level through Password policy. These rules apply whenever a user sets or changes their password.

To configure password policies:

1. Click Realm settings in the left sidebar.
2. Click the Authentication tab.
3. Click the Password policy tab.
4. Click Add policy and select from the available policy types:

Policy	What it enforces
Minimum length	Password must be at least N characters long
Special characters	Password must contain at least N special characters
Uppercase characters	Password must contain at least N uppercase letters
Lowercase characters	Password must contain at least N lowercase letters
Digits	Password must contain at least N digits
Not recently used	Password must not match any of the user’s last N passwords
Expire password	Password expires after N days; user is forced to change it
Password blacklist	Password must not appear in a configured blacklist file

5. Set the value for each policy you add.
6. Click Save.

Policies are enforced immediately for all new password changes. Existing passwords that pre-date a policy are not retroactively invalidated — only new sets or resets are checked.

What does enabling the "Temporary" flag when setting a password do?

The password expires after 24 hours automatically The user is forced to change the password on their next login The password is stored encrypted in a temporary cache The user receives an email with the temporary password

Where in the admin console do you configure the OTP type, algorithm, and token period for a realm?

Users → Credentials → OTP Settings Clients → Authentication → OTP Realm settings → Authentication → OTP policy Authentication → Flows → Browser

How does a user enroll their own OTP authenticator device in Keycloak?

An administrator assigns an OTP device to them from the admin console The user navigates to the Account Console, goes to Security, and sets up an authenticator application The user sends an email request to the realm administrator OTP enrollment happens automatically on first login

Which password policy prevents a user from reusing their recent passwords?

Expire password Minimum length Password blacklist Not recently used

Submit

Mark as complete