Keycloak signs users in against a realm on a Keycloak server you or your customer runs. It is the self-hosted option in the catalog: the directory stays on your infrastructure while Authdog fronts the application.

## Copy the redirect URI

In the [Authdog console](https://console.authdog.com), select the project and environment, open **Authentication > Providers**, find **Keycloak**, and click **Enable**. Copy the redirect URI shown in the form:

```url
https://identity.authdog.com/api/v1/callback/<connectionId>
```

## Create the realm client

1. Open the Keycloak admin console and select the realm.
2. Under **Clients**, create a client with **Client authentication** on — a confidential client.
3. Enable the **Standard flow** (authorization code).
4. Under **Valid redirect URIs**, add the redirect URI from Authdog.
5. Save, then copy the **Client ID** and the secret from the **Credentials** tab.
6. Note the realm base URL — that is the Domain URI.

## Configure Authdog

| Field | Value |
| --- | --- |
| **Client ID** | The client identifier from the provider |
| **Client Secret** | The client secret from the provider |
| **Domain URI** | The realm base URL, e.g. `https://keycloak.example.com/realms/acme` |

Save, then toggle the connection **active**.

## What Keycloak returns

Authdog requests the `openid email profile` scopes and reads the profile from the ID token the provider issues.

Claims come from the ID token the realm issues: `sub`, preferred username, email and its verified flag, and any protocol mappers you configured.

Use the realm base URL as the Domain URI — `https://host/realms/<realm>` — not the admin console URL and not the full authorize endpoint.

## Test it

1. Open your environment's hosted sign-in page, or link to `https://identity.authdog.com/api/v1/signin/<connectionId>`.
2. Select the Keycloak button and complete the flow.
3. Confirm the user appears under **Users** in the console with a Keycloak identity linked.

## Troubleshooting

| Symptom | Cause |
| --- | --- |
| `invalid_client` | The client is public rather than confidential, so it has no secret |
| `Invalid parameter: redirect_uri` | The URI is missing from the client's valid redirect URIs |
| 404 on authorize | The Domain URI is not the realm base |
| Redirect or callback URL error | The URI registered with the provider does not match Authdog's exactly |
| Works in one environment only | Each environment has its own `connectionId`, and so its own redirect URI to register |

## Related

| Read | To learn how to |
| --- | --- |
| [Connectors](/docs/connectors) | Set up any other social provider |
| [Enterprise SSO](/docs/sso) | Connect Keycloak as a generic OIDC enterprise connection |