Keycloak has no built-in unsubscribe management. Out of the box, it can handle login, logout, and user federation, but not granular user preference control for email or notifications. If you want users to opt out of marketing while keeping critical security alerts, you need to build it yourself or integrate a service that works with Keycloak.
Unsubscribe management in Keycloak starts with custom attributes. Add a user attribute like unsubscribe_marketing or email_preferences to store choices. This attribute can be updated through a custom REST endpoint or a Keycloak theme with a settings form. Then, modify your outbound email logic to check these flags before sending. If you use the built-in email templates, push preference data into your email service or queue so messages respect the user’s choices.
For complex scenarios—such as multiple subscription types, compliance with GDPR or CAN-SPAM, or one-click unsubscribe links—extend Keycloak with custom provider SPI (Service Provider Interface) modules. A custom EventListener SPI can log email sends, capture unsubscribes from HTTP endpoints, and update user attributes in real time. When paired with an external database or analytics tool, you can audit every opt-out and meet compliance requirements.