Production checklist
Keycloak production checklist: 5 checks before launch
5 checks for running Keycloak in production: 4 should-dos and 1 good-to-have. Each one says why it matters, how to verify it and where the docs are.
Updated . Every check links the vendor’s own docs.
Should do (4)
Run in production mode with HTTPS and a real hostname
Dev mode uses insecure defaults.
Verify from the command line
The server starts with start (not start-dev) and a real hostname behind HTTPS.
bin/kc.sh start --hostname=https://auth.<your-domain>
Don’t expose the admin console and admin API to the internet
Only the realm and resource paths need to be public; the admin endpoints are a prime target.
Verify with a request
From the internet, the admin paths should be blocked by your proxy while /realms/ still works.
curl -s -o /dev/null -w "%{http_code}\n" https://auth.<your-domain>/admin/Turn on brute-force detection in each realm
Locks accounts after repeated failed logins.
How to verify
In the admin console, Realm settings → Security defenses → Brute force detection is on for each realm.
Use a production database, not the built-in dev one
The dev database is for trying Keycloak out and isn’t meant for production data.
Check the config
keycloak.conf (or KC_DB) names a production database such as PostgreSQL.
db=postgres db-url=jdbc:postgresql://<host>/keycloak
Good to have (1)
Turn on health checks for your load balancer
Traffic then only goes to nodes that are ready.
Verify with a request
With health checks on, the management port reports the node as up.
curl -s http://localhost:9000/health/ready
Get the checklist for your whole stack
Design your stack or map your repo in StackPrism, and the Improve panel lists the checks for every technology on it and keeps track of what you’ve done. Building with an AI app builder? Start with the vibe coding checklist.