keycloak-cli

CLI tool for managing multiple Keycloak configurations and generating tokens.

Install

poetry install

Usage

kc --help

Quick Start

# Initialize your first Keycloak configuration
kc init

# Check server status
kc status

# Generate a token for a client
kc token get

Commands

kc init

Interactive setup wizard to create a Keycloak configuration. Prompts for organization, environment, server URL, realm, and admin credentials. Tests the connection before saving.

kc config — Configuration Management

Manage stored Keycloak server configurations (org/env pairs).

# List configs as table or JSON
kc config list --output json

# Switch default config
kc config use myorg/production

kc token — Token Management

Generate, cache, decode, and verify JWT access tokens.

# Get a token (uses cache if valid)
kc token get my-client

# Generate fresh token and copy to clipboard
kc token generate my-client --copy

# Output as Authorization header
kc token get my-client --as-header

# Decode a token from stdin
echo $TOKEN | kc token decode -

kc client — Client Management

Manage Keycloak clients via the Admin API.

# List clients (excludes internal clients by default)
kc client list

# Include internal clients
kc client list --all

# Search clients
kc client list --search my-app

# Create a client with service account
kc client create my-app --service-account --description "My application"

# Update client interactively
kc client update my-app

# Update client with flags
kc client update my-app --ttl 3600 --description "Updated"

# Regenerate client secret
kc client secret my-app --regenerate

kc status

Dashboard overview showing all configured servers, their health status, and which config is active.

kc health

Run health checks against a Keycloak server: connectivity, realm existence, token endpoint, and admin authentication.

# Check current config
kc health

# Check all configs
kc health --all

kc history

View recent CLI command history.

kc history
kc history --limit 50
kc history --clear

Global Options

Configuration

Configurations are stored at ~/.keycloak-cli/config.yaml. Each configuration is identified by an org/env pair (e.g., myorg/staging).

Token cache is stored at ~/.keycloak-cli/cache/tokens/.

License

GPL-3.0-or-later