Organizations
Per-Organization SSO, invitations, roles, and APIs. The foundation for B2B identity on Keycloak.
IdP Wizard
A guided flow that lets your customers configure their own SAML or OIDC identity provider without filing a ticket.
Magic Link
Email-link passwordless login plus API-triggered magic links for invitation and onboarding flows.
Admin Portal
An embeddable, scoped admin UI safe to expose to customer admins — they manage their users and SSO without the Keycloak console.
Events & Webhooks
Webhooks and scriptable event handlers. Export audit events to your stack and trigger workflows on identity events.
Themes
Modern, accessible, brandable login and account themes for Keycloak — production-ready out of the box.
User Migration
Move users from a legacy IdP without forcing a password reset. Authenticate against the old system on first login, then migrate transparently.
Containers
Production-ready container images with Phase Two extensions, opinionated defaults, and the build wiring you'd otherwise assemble yourself.
Built in public, run anywhere
Every extension on this page lives on GitHub under the Elastic License v2. Run them on your own Keycloak, fork them, or let us host the whole thing.