Keycloak Push Notifications
You set up keycloak push notifications by adding a custom extension or mobile provider. This step sends a login prompt to a user phone during sign-in. Out of the box, the server supports text codes and time-based tokens. It does not include a built-in mobile push engine. Teams must write custom Java providers or link an external messaging service. Once a user taps approve, the server grants a role token. If that role is too broad, the user gets wide system rights. How keycloak push notificati
Keycloak + Push-Based Authentication: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up keycloak push notifications by adding a custom extension or mobile provider. This step sends a login prompt to a user phone during sign-in.
Out of the box, the server supports text codes and time-based tokens. It does not include a built-in mobile push engine. Teams must write custom Java providers or link an external messaging service. Once a user taps approve, the server grants a role token. If that role is too broad, the user gets wide system rights.
How keycloak push notifications work in a login flow
A push flow starts when a user enters a username and password. The identity server checks those first details against its user store. Next, the server pauses the login flow and calls a custom step. This custom step reads the registered device token for that user.
The server then sends a request to an external push service. Google and Apple run the main delivery networks for mobile phones. The phone wakes up and shows an approval prompt to the user. Meanwhile, the browser waits and checks the server for a status update.
The user taps approve on the phone screen to confirm the login. The mobile app signs the challenge with a private key stored on the device. It sends that signed response back to the identity server endpoint. The server checks the signature with the public key on file. When the keys match, the server finishes the login and issues a token.
Device enrollment and key management
Before push prompts can work, each user must enroll a phone. The identity server shows a QR code during the first account setup. The user scans this code with a custom or third-party mobile app. During this scan, the phone creates a fresh cryptographic key pair.
The phone keeps the private key safe inside its hardware store. It sends the public key and a push address to the server. Admins must also manage lost phones and expired device tokens. If a user gets a new phone, an admin must reset the old key. Without a clear reset flow, users get locked out of their work tools.
Keycloak + Push-Based Authentication: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What push logins solve and the gap they leave open
Push prompts stop attackers who only have a stolen password. They are also faster for users than typing six-digit codes by hand. Because the phone signs the prompt with a key, phishing is harder. The login flow proves who the person is at the front door.
Still, a login check only decides who can enter the system. Once the server issues a token, its job is mostly done. The identity server cannot see what database queries or commands run next. An engineer who approves a push prompt might still get full admin rights.
With those broad rights, a single mistake can drop a production table. A query can also return raw emails, phone numbers, or card numbers. Login prompts do not rewrite sensitive fields in query results. They also do not require peer approval for a risky command in flight. Teams need controls that inspect each action after the user logs in.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
Does Keycloak support push notifications out of the box?
No, the core server only includes standard one-time password and web token steps. Teams must install a custom provider extension or connect an external tool.
What happens if a user phone has no internet during login?
The push message will not reach the phone without a data signal. Teams should keep a backup code method active in the login flow.
Do push notifications control what queries an engineer can run?
No, push prompts only check user identity when the session starts. They do not inspect or limit individual database statements or shell commands.