---
title: "Deploy Keycloak"
description: "Keycloak 26 SSO and identity server (OIDC, SAML), production mode, Postgres"
category: "Authentication"
url: https://railway.com/deploy/keycloak-2
---

# Deploy Keycloak

Keycloak 26 SSO and identity server (OIDC, SAML), production mode, Postgres

**[Deploy Keycloak on Railway](https://railway.com/template/keycloak-2)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/keycloak-2/manifest.json

- **Creator:** Agaz Self-Host
- **Category:** Authentication
- **Total deploys:** 1

## Template content

### Postgres https://devicons.railway.app/i/postgresql.svg

- **Image:** ghcr.io/railwayapp-templates/postgres-ssl:18@sha256:4fc833b43d2aaf6ecc9b18615f5533602b723a32d0e2efe2dae8ca0f7217c863

### Keycloak https://upload.wikimedia.org/wikipedia/commons/2/29/Keycloak_Logo.png?utm_source=commons.wikimedia.org&utm_campaign=index&utm_content=thumbnail_unscaled&_=20200311211229

- **Image:** quay.io/keycloak/keycloak:26.8.2@sha256:723b1d6e254c0fc96d5cffec860c7e0744d6a3277822b865bb538cf891575e41
- **Start command:** `/bin/sh -c 'export KC_DB="${KC_DB:-postgres}" KC_HTTP_ENABLED="${KC_HTTP_ENABLED:-true}" KC_HTTP_PORT="${KC_HTTP_PORT:-${PORT:-8080}}" KC_PROXY_HEADERS="${KC_PROXY_HEADERS:-xforwarded}" KC_HEALTH_ENABLED="${KC_HEALTH_ENABLED:-true}" KC_HTTP_MANAGEMENT_HEALTH_ENABLED="${KC_HTTP_MANAGEMENT_HEALTH_ENABLED:-false}" KC_BOOTSTRAP_ADMIN_USERNAME="${KC_BOOTSTRAP_ADMIN_USERNAME:-admin}" KC_CACHE="${KC_CACHE:-local}" JAVA_OPTS_KC_HEAP="${JAVA_OPTS_KC_HEAP:--Xms64m -Xmx1g -XX:MaxHeapFreeRatio=10 -XX:MinHeapFreeRatio=5}"; exec /opt/keycloak/bin/kc.sh start'`
- **Health check:** /health/ready
- **Public domain:** Yes

## Documentation

# Deploy and Host Keycloak on Railway

Keycloak is an open-source identity and access management server maintained under the Cloud Native Computing Foundation. It adds single sign-on to your apps over OpenID Connect, OAuth 2.0 and SAML, with user federation (LDAP and Active Directory), social and external identity providers, multi-factor authentication, and admin and account consoles.

## About Hosting Keycloak

Hosting Keycloak means running its Java server in production mode next to a database, behind a TLS-terminating proxy. This template runs the official Keycloak 26.8.2 image with Railway's PostgreSQL 18 on the private network. Keycloak trusts Railway's forwarded headers, so its public URL, issuer and redirects use your HTTPS domain. A bootstrap admin account is created on first start with a generated password. All realms, users, clients and sessions are stored in Postgres, which keeps its data on a Railway volume. The first start takes about a minute while Keycloak builds its configuration and creates the database schema.

## Common Use Cases

* Single sign-on for internal tools and self-hosted apps over OpenID Connect or SAML
* Login, registration, password reset and MFA for your own web or mobile app
* A central identity broker in front of Google, GitHub, Microsoft or an LDAP/Active Directory directory

## Dependencies for Keycloak Hosting

* PostgreSQL (included, with a volume for its data)
* A public HTTPS domain (Railway generates one for the Keycloak service)

### Deployment Dependencies

* Keycloak 26.8.2 release: https://github.com/keycloak/keycloak/releases/tag/26.8.2
* Keycloak container guide: https://www.keycloak.org/server/containers
* Reverse proxy settings: https://www.keycloak.org/server/reverseproxy
* Hostname settings: https://www.keycloak.org/server/hostname
* Database settings: https://www.keycloak.org/server/db
* Health checks: https://www.keycloak.org/observability/health
* All configuration options: https://www.keycloak.org/server/all-config

### Implementation Details

**First sign-in:** open your Railway domain, choose "Administration Console", and sign in as `admin` with the `KC_BOOTSTRAP_ADMIN_PASSWORD` value from the Keycloak service's Variables tab. Keycloak marks this bootstrap account as temporary, so create a permanent admin user in the master realm and then delete or disable the bootstrap one. Changing `KC_BOOTSTRAP_ADMIN_PASSWORD` after the first start has no effect.

**Configuration:** the start command runs `kc.sh start` (production mode) with these defaults, and any of them can be overridden by adding the variable to the Keycloak service:

```
KC_DB=postgres
KC_HTTP_ENABLED=true            # Railway terminates TLS
KC_PROXY_HEADERS=xforwarded
KC_HEALTH_ENABLED=true
KC_HTTP_MANAGEMENT_HEALTH_ENABLED=false   # /health/ready on the main port for Railway's health check
KC_CACHE=local                  # single instance
JAVA_OPTS_KC_HEAP=-Xms64m -Xmx1g -XX:MaxHeapFreeRatio=10 -XX:MinHeapFreeRatio=5
```

`KC_HOSTNAME` is set to `https://${{RAILWAY_PUBLIC_DOMAIN}}`. If you add a custom domain, change `KC_HOSTNAME` to it and redeploy. The template is set up for one replica. Before you scale out, set `KC_CACHE=ispn` and read Keycloak's caching guide. An idle instance uses about 0.8 GB of memory.

## Why Deploy Keycloak on Railway?


Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Keycloak on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.




## Similar templates

- [Keycloak](https://railway.com/deploy/mSwigX) — [2026-11-04] Keycloak with keywind theme + Apple & Discord providers
- [lua-protector](https://railway.com/deploy/lua-protector) — Test deployed my project first
- [bknd](https://railway.com/deploy/p4nTYL) — Feature-rich yet lightweight backend

Open this page in a browser: https://railway.com/deploy/keycloak-2