
:guide-id: all-config
:guide-title: All configuration
:guide-summary: Review build options and configuration for {project_name}.
:guide-priority: 999
:guide-tile-visible: true
:version: 26.3.0

include::../attributes.adoc[]

[[all-config]]
= All configuration

ifeval::["" == "true"]
WARNING: This {section} is describing a feature which is currently in preview.
ifeval::["" == ""]
Please provide your feedback while we’re continuing to work on this.
endif::[]
ifeval::["" != ""]
Please provide your feedback by link:[joining this discussion] while we’re continuing to work on this.
endif::[]
endif::[]


[#category-cache]
== Cache

[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+cache+`# 

[.options-description]#Defines the cache mechanism for high-availability.#

[#option-extended-cache,role="options-extended"]
--
[.options-description-extended]#By default in production mode, a `ispn` cache is used to create a cluster between multiple server nodes. By default in development mode, a `local` cache disables clustering and is intended for development and testing purposes.#

*CLI:* `+--cache+` +
*Env:* `+KC_CACHE+`
--



|
`+ispn+` (default), `+local+`

|
[.options-key]#`+cache-config-file+`# 

[.options-description]#Defines the file from which cache configuration should be loaded from.#

[#option-extended-cache-config-file,role="options-extended"]
--
[.options-description-extended]#The configuration file is relative to the `conf/` directory.#

*CLI:* `+--cache-config-file+` +
*Env:* `+KC_CACHE_CONFIG_FILE+`
--



|

|
[.options-key]#`+cache-embedded-authorization-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the authorization cache.#

[#option-extended-cache-embedded-authorization-max-count,role="options-extended"]
--


*CLI:* `+--cache-embedded-authorization-max-count+` +
*Env:* `+KC_CACHE_EMBEDDED_AUTHORIZATION_MAX_COUNT+`
--



|

|
[.options-key]#`+cache-embedded-client-sessions-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the clientSessions cache.#

[#option-extended-cache-embedded-client-sessions-max-count,role="options-extended"]
--


*CLI:* `+--cache-embedded-client-sessions-max-count+` +
*Env:* `+KC_CACHE_EMBEDDED_CLIENT_SESSIONS_MAX_COUNT+`
--

Available only when embedded Infinispan clusters configured


|

|
[.options-key]#`+cache-embedded-crl-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the crl cache.#

[#option-extended-cache-embedded-crl-max-count,role="options-extended"]
--


*CLI:* `+--cache-embedded-crl-max-count+` +
*Env:* `+KC_CACHE_EMBEDDED_CRL_MAX_COUNT+`
--



|

|
[.options-key]#`+cache-embedded-keys-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the keys cache.#

[#option-extended-cache-embedded-keys-max-count,role="options-extended"]
--


*CLI:* `+--cache-embedded-keys-max-count+` +
*Env:* `+KC_CACHE_EMBEDDED_KEYS_MAX_COUNT+`
--



|

|
[.options-key]#`+cache-embedded-mtls-enabled+`# 

[.options-description]#Encrypts the network communication between Keycloak servers.#

[#option-extended-cache-embedded-mtls-enabled,role="options-extended"]
--
[.options-description-extended]#If no additional parameters about a keystore and truststore are provided, ephemeral key pairs and certificates are created and rotated automatically, which is recommended for standard setups.#

*CLI:* `+--cache-embedded-mtls-enabled+` +
*Env:* `+KC_CACHE_EMBEDDED_MTLS_ENABLED+`
--

Available only when a TCP based cache-stack is used


|
`+true+` (default), `+false+`

|
[.options-key]#`+cache-embedded-mtls-key-store-file+`# 

[.options-description]#The Keystore file path.#

[#option-extended-cache-embedded-mtls-key-store-file,role="options-extended"]
--
[.options-description-extended]#The Keystore must contain the certificate to use by the TLS protocol. By default, it looks up `cache-mtls-keystore.p12` under conf/ directory.#

*CLI:* `+--cache-embedded-mtls-key-store-file+` +
*Env:* `+KC_CACHE_EMBEDDED_MTLS_KEY_STORE_FILE+`
--

Available only when property 'cache-embedded-mtls-enabled' is enabled


|

|
[.options-key]#`+cache-embedded-mtls-key-store-password+`# 

[.options-description]#The password to access the Keystore.#

[#option-extended-cache-embedded-mtls-key-store-password,role="options-extended"]
--


*CLI:* `+--cache-embedded-mtls-key-store-password+` +
*Env:* `+KC_CACHE_EMBEDDED_MTLS_KEY_STORE_PASSWORD+`
--

Available only when property 'cache-embedded-mtls-enabled' is enabled


|

|
[.options-key]#`+cache-embedded-mtls-rotation-interval-days+`# 

[.options-description]#Rotation period in days of automatic JGroups MTLS certificates.#

[#option-extended-cache-embedded-mtls-rotation-interval-days,role="options-extended"]
--


*CLI:* `+--cache-embedded-mtls-rotation-interval-days+` +
*Env:* `+KC_CACHE_EMBEDDED_MTLS_ROTATION_INTERVAL_DAYS+`
--

Available only when property 'cache-embedded-mtls-enabled' is enabled


|[.options-default]#`+30+`# (default)

|
[.options-key]#`+cache-embedded-mtls-trust-store-file+`# 

[.options-description]#The Truststore file path.#

[#option-extended-cache-embedded-mtls-trust-store-file,role="options-extended"]
--
[.options-description-extended]#It should contain the trusted certificates or the Certificate Authority that signed the certificates. By default, it lookup `cache-mtls-truststore.p12` under conf/ directory.#

*CLI:* `+--cache-embedded-mtls-trust-store-file+` +
*Env:* `+KC_CACHE_EMBEDDED_MTLS_TRUST_STORE_FILE+`
--

Available only when property 'cache-embedded-mtls-enabled' is enabled


|

|
[.options-key]#`+cache-embedded-mtls-trust-store-password+`# 

[.options-description]#The password to access the Truststore.#

[#option-extended-cache-embedded-mtls-trust-store-password,role="options-extended"]
--


*CLI:* `+--cache-embedded-mtls-trust-store-password+` +
*Env:* `+KC_CACHE_EMBEDDED_MTLS_TRUST_STORE_PASSWORD+`
--

Available only when property 'cache-embedded-mtls-enabled' is enabled


|

|
[.options-key]#`+cache-embedded-offline-client-sessions-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the offlineClientSessions cache.#

[#option-extended-cache-embedded-offline-client-sessions-max-count,role="options-extended"]
--


*CLI:* `+--cache-embedded-offline-client-sessions-max-count+` +
*Env:* `+KC_CACHE_EMBEDDED_OFFLINE_CLIENT_SESSIONS_MAX_COUNT+`
--

Available only when embedded Infinispan clusters configured


|

|
[.options-key]#`+cache-embedded-offline-sessions-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the offlineSessions cache.#

[#option-extended-cache-embedded-offline-sessions-max-count,role="options-extended"]
--


*CLI:* `+--cache-embedded-offline-sessions-max-count+` +
*Env:* `+KC_CACHE_EMBEDDED_OFFLINE_SESSIONS_MAX_COUNT+`
--

Available only when embedded Infinispan clusters configured


|

|
[.options-key]#`+cache-embedded-realms-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the realms cache.#

[#option-extended-cache-embedded-realms-max-count,role="options-extended"]
--


*CLI:* `+--cache-embedded-realms-max-count+` +
*Env:* `+KC_CACHE_EMBEDDED_REALMS_MAX_COUNT+`
--



|

|
[.options-key]#`+cache-embedded-sessions-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the sessions cache.#

[#option-extended-cache-embedded-sessions-max-count,role="options-extended"]
--


*CLI:* `+--cache-embedded-sessions-max-count+` +
*Env:* `+KC_CACHE_EMBEDDED_SESSIONS_MAX_COUNT+`
--

Available only when embedded Infinispan clusters configured


|

|
[.options-key]#`+cache-embedded-users-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the users cache.#

[#option-extended-cache-embedded-users-max-count,role="options-extended"]
--


*CLI:* `+--cache-embedded-users-max-count+` +
*Env:* `+KC_CACHE_EMBEDDED_USERS_MAX_COUNT+`
--



|

|
[.options-key]#`+cache-metrics-histograms-enabled+`# 

[.options-description]#Enable histograms for metrics for the embedded caches.#

[#option-extended-cache-metrics-histograms-enabled,role="options-extended"]
--


*CLI:* `+--cache-metrics-histograms-enabled+` +
*Env:* `+KC_CACHE_METRICS_HISTOGRAMS_ENABLED+`
--

Available only when metrics are enabled


|
`+true+`, `+false+` (default)

|
[.options-key]#`+cache-remote-host+`# 

[.options-description]#The hostname of the external Infinispan cluster.#

[#option-extended-cache-remote-host,role="options-extended"]
--
[.options-description-extended]#Available only when feature `multi-site` or `clusterless` is set.#

*CLI:* `+--cache-remote-host+` +
*Env:* `+KC_CACHE_REMOTE_HOST+`
--



|

|
[.options-key]#`+cache-remote-password+`# 

[.options-description]#The password for the authentication to the external Infinispan cluster.#

[#option-extended-cache-remote-password,role="options-extended"]
--
[.options-description-extended]#It is optional if connecting to an unsecure external Infinispan cluster. If the option is specified, `cache-remote-username` is required as well.#

*CLI:* `+--cache-remote-password+` +
*Env:* `+KC_CACHE_REMOTE_PASSWORD+`
--

Available only when remote host is set


|

|
[.options-key]#`+cache-remote-port+`# 

[.options-description]#The port of the external Infinispan cluster.#

[#option-extended-cache-remote-port,role="options-extended"]
--


*CLI:* `+--cache-remote-port+` +
*Env:* `+KC_CACHE_REMOTE_PORT+`
--

Available only when remote host is set


|[.options-default]#`+11222+`# (default)

|
[.options-key]#`+cache-remote-tls-enabled+`# 

[.options-description]#Enable TLS support to communicate with a secured remote Infinispan server.#

[#option-extended-cache-remote-tls-enabled,role="options-extended"]
--
[.options-description-extended]#Recommended to be enabled in production.#

*CLI:* `+--cache-remote-tls-enabled+` +
*Env:* `+KC_CACHE_REMOTE_TLS_ENABLED+`
--

Available only when remote host is set


|
`+true+` (default), `+false+`

|
[.options-key]#`+cache-remote-username+`# 

[.options-description]#The username for the authentication to the external Infinispan cluster.#

[#option-extended-cache-remote-username,role="options-extended"]
--
[.options-description-extended]#It is optional if connecting to an unsecure external Infinispan cluster. If the option is specified, `cache-remote-password` is required as well.#

*CLI:* `+--cache-remote-username+` +
*Env:* `+KC_CACHE_REMOTE_USERNAME+`
--

Available only when remote host is set


|

|
[.options-key]#`+cache-stack+`# 

[.options-description]#Define the default stack to use for cluster communication and node discovery.#

[#option-extended-cache-stack,role="options-extended"]
--
[.options-description-extended]#Defaults to `jdbc-ping` if not set.#

*CLI:* `+--cache-stack+` +
*Env:* `+KC_CACHE_STACK+`
--

Available only when 'cache' type is set to 'ispn'

Use 'jdbc-ping' instead by leaving it unset
*Deprecated values: `+azure+`, `+ec2+`, `+google+`, `+jdbc-ping-udp+`, `+kubernetes+`, `+tcp+`, `+udp+`*

|
`+jdbc-ping+`, `+kubernetes+` (deprecated), `+jdbc-ping-udp+` (deprecated), `+tcp+` (deprecated), `+udp+` (deprecated), `+ec2+` (deprecated), `+azure+` (deprecated), `+google+` (deprecated), or any


|===
[#category-config]
== Config

[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+config-keystore+`# 

[.options-description]#Specifies a path to the KeyStore Configuration Source.#

[#option-extended-config-keystore,role="options-extended"]
--


*CLI:* `+--config-keystore+` +
*Env:* `+KC_CONFIG_KEYSTORE+`
--



|

|
[.options-key]#`+config-keystore-password+`# 

[.options-description]#Specifies a password to the KeyStore Configuration Source.#

[#option-extended-config-keystore-password,role="options-extended"]
--


*CLI:* `+--config-keystore-password+` +
*Env:* `+KC_CONFIG_KEYSTORE_PASSWORD+`
--



|

|
[.options-key]#`+config-keystore-type+`# 

[.options-description]#Specifies a type of the KeyStore Configuration Source.#

[#option-extended-config-keystore-type,role="options-extended"]
--


*CLI:* `+--config-keystore-type+` +
*Env:* `+KC_CONFIG_KEYSTORE_TYPE+`
--



|[.options-default]#`+PKCS12+`# (default)


|===
[#category-database]
== Database

[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+db+`# [.none]#icon:tools[role=options-build]#

[.options-description]#The database vendor.#

[#option-extended-db,role="options-extended"]
--
[.options-description-extended]#In production mode the default value of `dev-file` is deprecated, you should explicitly specify the db instead.#

*CLI:* `+--db+` +
*Env:* `+KC_DB+`
--



|
`+dev-file+` (default), `+dev-mem+`, `+mariadb+`, `+mssql+`, `+mysql+`, `+oracle+`, `+postgres+`

|
[.options-key]#`+db-debug-jpql+`# 

[.options-description]#Add JPQL information as comments to SQL statements to debug JPA SQL statement generation.#

[#option-extended-db-debug-jpql,role="options-extended"]
--


*CLI:* `+--db-debug-jpql+` +
*Env:* `+KC_DB_DEBUG_JPQL+`
--



|
`+true+`, `+false+` (default)

|
[.options-key]#`+db-driver+`# [.none]#icon:tools[role=options-build]#

[.options-description]#The fully qualified class name of the JDBC driver.#

[#option-extended-db-driver,role="options-extended"]
--
[.options-description-extended]#If not set, a default driver is set accordingly to the chosen database.#

*CLI:* `+--db-driver+` +
*Env:* `+KC_DB_DRIVER+`
--



|

|
[.options-key]#`+db-log-slow-queries-threshold+`# 

[.options-description]#Log SQL statements slower than the configured threshold with logger org.#

[#option-extended-db-log-slow-queries-threshold,role="options-extended"]
--
[.options-description-extended]#hibernate.SQL_SLOW and log-level info.#

*CLI:* `+--db-log-slow-queries-threshold+` +
*Env:* `+KC_DB_LOG_SLOW_QUERIES_THRESHOLD+`
--



|[.options-default]#`+10000+`# (default)

|
[.options-key]#`+db-password+`# 

[.options-description]#The password of the database user.#

[#option-extended-db-password,role="options-extended"]
--


*CLI:* `+--db-password+` +
*Env:* `+KC_DB_PASSWORD+`
--



|

|
[.options-key]#`+db-pool-initial-size+`# 

[.options-description]#The initial size of the connection pool.#

[#option-extended-db-pool-initial-size,role="options-extended"]
--


*CLI:* `+--db-pool-initial-size+` +
*Env:* `+KC_DB_POOL_INITIAL_SIZE+`
--



|

|
[.options-key]#`+db-pool-max-size+`# 

[.options-description]#The maximum size of the connection pool.#

[#option-extended-db-pool-max-size,role="options-extended"]
--


*CLI:* `+--db-pool-max-size+` +
*Env:* `+KC_DB_POOL_MAX_SIZE+`
--



|[.options-default]#`+100+`# (default)

|
[.options-key]#`+db-pool-min-size+`# 

[.options-description]#The minimal size of the connection pool.#

[#option-extended-db-pool-min-size,role="options-extended"]
--


*CLI:* `+--db-pool-min-size+` +
*Env:* `+KC_DB_POOL_MIN_SIZE+`
--



|

|
[.options-key]#`+db-schema+`# 

[.options-description]#The database schema to be used.#

[#option-extended-db-schema,role="options-extended"]
--


*CLI:* `+--db-schema+` +
*Env:* `+KC_DB_SCHEMA+`
--



|

|
[.options-key]#`+db-url+`# 

[.options-description]#The full database JDBC URL.#

[#option-extended-db-url,role="options-extended"]
--
[.options-description-extended]#If not provided, a default URL is set based on the selected database vendor. For instance, if using `postgres`, the default JDBC URL would be `jdbc:postgresql://localhost/keycloak`.#

*CLI:* `+--db-url+` +
*Env:* `+KC_DB_URL+`
--



|

|
[.options-key]#`+db-url-database+`# 

[.options-description]#Sets the database name of the default JDBC URL of the chosen vendor.#

[#option-extended-db-url-database,role="options-extended"]
--
[.options-description-extended]#If the `db-url` option is set, this option is ignored.#

*CLI:* `+--db-url-database+` +
*Env:* `+KC_DB_URL_DATABASE+`
--



|

|
[.options-key]#`+db-url-host+`# 

[.options-description]#Sets the hostname of the default JDBC URL of the chosen vendor.#

[#option-extended-db-url-host,role="options-extended"]
--
[.options-description-extended]#If the `db-url` option is set, this option is ignored.#

*CLI:* `+--db-url-host+` +
*Env:* `+KC_DB_URL_HOST+`
--



|

|
[.options-key]#`+db-url-port+`# 

[.options-description]#Sets the port of the default JDBC URL of the chosen vendor.#

[#option-extended-db-url-port,role="options-extended"]
--
[.options-description-extended]#If the `db-url` option is set, this option is ignored.#

*CLI:* `+--db-url-port+` +
*Env:* `+KC_DB_URL_PORT+`
--



|

|
[.options-key]#`+db-url-properties+`# 

[.options-description]#Sets the properties of the default JDBC URL of the chosen vendor.#

[#option-extended-db-url-properties,role="options-extended"]
--
[.options-description-extended]#Make sure to set the properties accordingly to the format expected by the database vendor, as well as appending the right character at the beginning of this property value. If the `db-url` option is set, this option is ignored.#

*CLI:* `+--db-url-properties+` +
*Env:* `+KC_DB_URL_PROPERTIES+`
--



|

|
[.options-key]#`+db-username+`# 

[.options-description]#The username of the database user.#

[#option-extended-db-username,role="options-extended"]
--


*CLI:* `+--db-username+` +
*Env:* `+KC_DB_USERNAME+`
--



|


|===
[#category-transaction]
== Transaction

[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+transaction-xa-enabled+`# [.none]#icon:tools[role=options-build]#

[.options-description]#If set to true, XA datasources will be used.#

[#option-extended-transaction-xa-enabled,role="options-extended"]
--


*CLI:* `+--transaction-xa-enabled+` +
*Env:* `+KC_TRANSACTION_XA_ENABLED+`
--



|
`+true+`, `+false+` (default)


|===
[#category-feature]
== Feature

[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+features+`# [.none]#icon:tools[role=options-build]#

[.options-description]#Enables a set of one or more features.#

[#option-extended-features,role="options-extended"]
--


*CLI:* `+--features+` +
*Env:* `+KC_FEATURES+`
--



|
`+account-api[:v1]+`, `+account[:v3]+`, `+admin-api[:v1]+`, `+admin-fine-grained-authz[:v1,v2]+`, `+admin[:v2]+`, `+authorization[:v1]+`, `+ciba[:v1]+`, `+client-policies[:v1]+`, `+client-secret-rotation[:v1]+`, `+client-types[:v1]+`, `+clusterless[:v1]+`, `+declarative-ui[:v1]+`, `+device-flow[:v1]+`, `+docker[:v1]+`, `+dpop[:v1]+`, `+dynamic-scopes[:v1]+`, `+fips[:v1]+`, `+hostname[:v2]+`, `+impersonation[:v1]+`, `+instagram-broker[:v1]+`, `+ipa-tuura-federation[:v1]+`, `+kerberos[:v1]+`, `+login[:v2,v1]+`, `+logout-all-sessions[:v1]+`, `+multi-site[:v1]+`, `+oid4vc-vci[:v1]+`, `+opentelemetry[:v1]+`, `+organization[:v1]+`, `+par[:v1]+`, `+passkeys[:v1]+`, `+persistent-user-sessions[:v1]+`, `+preview+`, `+quick-theme[:v1]+`, `+recovery-codes[:v1]+`, `+rolling-updates[:v1,v2]+`, `+scripts[:v1]+`, `+step-up-authentication[:v1]+`, `+token-exchange-external-internal[:v2]+`, `+token-exchange-standard[:v2]+`, `+token-exchange[:v1]+`, `+transient-users[:v1]+`, `+update-email[:v1]+`, `+user-event-metrics[:v1]+`, `+web-authn[:v1]+`

|
[.options-key]#`+features-disabled+`# [.none]#icon:tools[role=options-build]#

[.options-description]#Disables a set of one or more features.#

[#option-extended-features-disabled,role="options-extended"]
--


*CLI:* `+--features-disabled+` +
*Env:* `+KC_FEATURES_DISABLED+`
--



|
`+account+`, `+account-api+`, `+admin+`, `+admin-api+`, `+admin-fine-grained-authz+`, `+authorization+`, `+ciba+`, `+client-policies+`, `+client-secret-rotation+`, `+client-types+`, `+clusterless+`, `+declarative-ui+`, `+device-flow+`, `+docker+`, `+dpop+`, `+dynamic-scopes+`, `+fips+`, `+impersonation+`, `+instagram-broker+`, `+ipa-tuura-federation+`, `+kerberos+`, `+login+`, `+logout-all-sessions+`, `+multi-site+`, `+oid4vc-vci+`, `+opentelemetry+`, `+organization+`, `+par+`, `+passkeys+`, `+persistent-user-sessions+`, `+preview+`, `+quick-theme+`, `+recovery-codes+`, `+rolling-updates+`, `+scripts+`, `+step-up-authentication+`, `+token-exchange+`, `+token-exchange-external-internal+`, `+token-exchange-standard+`, `+transient-users+`, `+update-email+`, `+user-event-metrics+`, `+web-authn+`


|===
[#category-hostname_v2]
== Hostname v2

[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+hostname+`# 

[.options-description]#Address at which is the server exposed.#

[#option-extended-hostname,role="options-extended"]
--
[.options-description-extended]#Can be a full URL, or just a hostname. When only hostname is provided, scheme, port and context path are resolved from the request.#

*CLI:* `+--hostname+` +
*Env:* `+KC_HOSTNAME+`
--

Available only when hostname:v2 feature is enabled


|

|
[.options-key]#`+hostname-admin+`# 

[.options-description]#Address for accessing the administration console.#

[#option-extended-hostname-admin,role="options-extended"]
--
[.options-description-extended]#Use this option if you are exposing the administration console using a reverse proxy on a different address than specified in the `hostname` option.#

*CLI:* `+--hostname-admin+` +
*Env:* `+KC_HOSTNAME_ADMIN+`
--

Available only when hostname:v2 feature is enabled


|

|
[.options-key]#`+hostname-backchannel-dynamic+`# 

[.options-description]#Enables dynamic resolving of backchannel URLs, including hostname, scheme, port and context path.#

[#option-extended-hostname-backchannel-dynamic,role="options-extended"]
--
[.options-description-extended]#Set to true if your application accesses Keycloak via a private network. If set to true, `hostname` option needs to be specified as a full URL.#

*CLI:* `+--hostname-backchannel-dynamic+` +
*Env:* `+KC_HOSTNAME_BACKCHANNEL_DYNAMIC+`
--

Available only when hostname:v2 feature is enabled


|
`+true+`, `+false+` (default)

|
[.options-key]#`+hostname-debug+`# 

[.options-description]#Toggles the hostname debug page that is accessible at /realms/master/hostname-debug.#

[#option-extended-hostname-debug,role="options-extended"]
--


*CLI:* `+--hostname-debug+` +
*Env:* `+KC_HOSTNAME_DEBUG+`
--

Available only when hostname:v2 feature is enabled


|
`+true+`, `+false+` (default)

|
[.options-key]#`+hostname-strict+`# 

[.options-description]#Disables dynamically resolving the hostname from request headers.#

[#option-extended-hostname-strict,role="options-extended"]
--
[.options-description-extended]#Should always be set to true in production, unless your reverse proxy overwrites the Host header. If enabled, the `hostname` option needs to be specified.#

*CLI:* `+--hostname-strict+` +
*Env:* `+KC_HOSTNAME_STRICT+`
--

Available only when hostname:v2 feature is enabled


|
`+true+` (default), `+false+`


|===
[#category-http]
== HTTP(S)

[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+http-enabled+`# 

[.options-description]#Enables the HTTP listener.#

[#option-extended-http-enabled,role="options-extended"]
--
[.options-description-extended]#Enabled by default in development mode. Typically not enabled in production unless the server is fronted by a TLS termination proxy.#

*CLI:* `+--http-enabled+` +
*Env:* `+KC_HTTP_ENABLED+`
--



|
`+true+`, `+false+` (default)

|
[.options-key]#`+http-host+`# 

[.options-description]#The HTTP Host.#

[#option-extended-http-host,role="options-extended"]
--


*CLI:* `+--http-host+` +
*Env:* `+KC_HTTP_HOST+`
--



|[.options-default]#`+0.0.0.0+`# (default)

|
[.options-key]#`+http-max-queued-requests+`# 

[.options-description]#Maximum number of queued HTTP requests.#

[#option-extended-http-max-queued-requests,role="options-extended"]
--
[.options-description-extended]#Use this to shed load in an overload situation. Excess requests will return a "503 Server not Available" response.#

*CLI:* `+--http-max-queued-requests+` +
*Env:* `+KC_HTTP_MAX_QUEUED_REQUESTS+`
--



|

|
[.options-key]#`+http-metrics-histograms-enabled+`# 

[.options-description]#Enables a histogram with default buckets for the duration of HTTP server requests.#

[#option-extended-http-metrics-histograms-enabled,role="options-extended"]
--


*CLI:* `+--http-metrics-histograms-enabled+` +
*Env:* `+KC_HTTP_METRICS_HISTOGRAMS_ENABLED+`
--

Available only when metrics are enabled


|
`+true+`, `+false+` (default)

|
[.options-key]#`+http-metrics-slos+`# 

[.options-description]#Service level objectives for HTTP server requests.#

[#option-extended-http-metrics-slos,role="options-extended"]
--
[.options-description-extended]#Use this instead of the default histogram, or use it in combination to add additional buckets. Specify a list of comma-separated values defined in milliseconds. Example with buckets from 5ms to 10s: 5,10,25,50,250,500,1000,2500,5000,10000#

*CLI:* `+--http-metrics-slos+` +
*Env:* `+KC_HTTP_METRICS_SLOS+`
--

Available only when metrics are enabled


|

|
[.options-key]#`+http-pool-max-threads+`# 

[.options-description]#The maximum number of threads.#

[#option-extended-http-pool-max-threads,role="options-extended"]
--
[.options-description-extended]#If this is not specified then it will be automatically sized to the greater of 4 * the number of available processors and 50. For example if there are 4 processors the max threads will be 50. If there are 48 processors it will be 192.#

*CLI:* `+--http-pool-max-threads+` +
*Env:* `+KC_HTTP_POOL_MAX_THREADS+`
--



|

|
[.options-key]#`+http-port+`# 

[.options-description]#The used HTTP port.#

[#option-extended-http-port,role="options-extended"]
--


*CLI:* `+--http-port+` +
*Env:* `+KC_HTTP_PORT+`
--



|[.options-default]#`+8080+`# (default)

|
[.options-key]#`+http-relative-path+`# [.none]#icon:tools[role=options-build]#

[.options-description]#Set the path relative to `/` for serving resources.#

[#option-extended-http-relative-path,role="options-extended"]
--
[.options-description-extended]#The path must start with a `/`.#

*CLI:* `+--http-relative-path+` +
*Env:* `+KC_HTTP_RELATIVE_PATH+`
--



|[.options-default]#`+/+`# (default)

|
[.options-key]#`+https-certificate-file+`# 

[.options-description]#The file path to a server certificate or certificate chain in PEM format.#

[#option-extended-https-certificate-file,role="options-extended"]
--


*CLI:* `+--https-certificate-file+` +
*Env:* `+KC_HTTPS_CERTIFICATE_FILE+`
--



|

|
[.options-key]#`+https-certificate-key-file+`# 

[.options-description]#The file path to a private key in PEM format.#

[#option-extended-https-certificate-key-file,role="options-extended"]
--


*CLI:* `+--https-certificate-key-file+` +
*Env:* `+KC_HTTPS_CERTIFICATE_KEY_FILE+`
--



|

|
[.options-key]#`+https-certificates-reload-period+`# 

[.options-description]#Interval on which to reload key store, trust store, and certificate files referenced by https-* options.#

[#option-extended-https-certificates-reload-period,role="options-extended"]
--
[.options-description-extended]#May be a java.time.Duration value, an integer number of seconds, or an integer followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1 to disable.#

*CLI:* `+--https-certificates-reload-period+` +
*Env:* `+KC_HTTPS_CERTIFICATES_RELOAD_PERIOD+`
--



|[.options-default]#`+1h+`# (default)

|
[.options-key]#`+https-cipher-suites+`# 

[.options-description]#The cipher suites to use.#

[#option-extended-https-cipher-suites,role="options-extended"]
--
[.options-description-extended]#If none is given, a reasonable default is selected.#

*CLI:* `+--https-cipher-suites+` +
*Env:* `+KC_HTTPS_CIPHER_SUITES+`
--



|

|
[.options-key]#`+https-client-auth+`# [.none]#icon:tools[role=options-build]#

[.options-description]#Configures the server to require/request client authentication.#

[#option-extended-https-client-auth,role="options-extended"]
--


*CLI:* `+--https-client-auth+` +
*Env:* `+KC_HTTPS_CLIENT_AUTH+`
--



|
`+none+` (default), `+request+`, `+required+`

|
[.options-key]#`+https-key-store-file+`# 

[.options-description]#The key store which holds the certificate information instead of specifying separate files.#

[#option-extended-https-key-store-file,role="options-extended"]
--


*CLI:* `+--https-key-store-file+` +
*Env:* `+KC_HTTPS_KEY_STORE_FILE+`
--



|

|
[.options-key]#`+https-key-store-password+`# 

[.options-description]#The password of the key store file.#

[#option-extended-https-key-store-password,role="options-extended"]
--


*CLI:* `+--https-key-store-password+` +
*Env:* `+KC_HTTPS_KEY_STORE_PASSWORD+`
--



|[.options-default]#`+password+`# (default)

|
[.options-key]#`+https-key-store-type+`# 

[.options-description]#The type of the key store file.#

[#option-extended-https-key-store-type,role="options-extended"]
--
[.options-description-extended]#If not given, the type is automatically detected based on the file extension. If `fips-mode` is set to `strict` and no value is set, it defaults to `BCFKS`.#

*CLI:* `+--https-key-store-type+` +
*Env:* `+KC_HTTPS_KEY_STORE_TYPE+`
--



|

|
[.options-key]#`+https-port+`# 

[.options-description]#The used HTTPS port.#

[#option-extended-https-port,role="options-extended"]
--


*CLI:* `+--https-port+` +
*Env:* `+KC_HTTPS_PORT+`
--



|[.options-default]#`+8443+`# (default)

|
[.options-key]#`+https-protocols+`# 

[.options-description]#The list of protocols to explicitly enable.#

[#option-extended-https-protocols,role="options-extended"]
--


*CLI:* `+--https-protocols+` +
*Env:* `+KC_HTTPS_PROTOCOLS+`
--



|[.options-default]#`+[TLSv1.3,TLSv1.2]+`# (default)

|
[.options-key]#`+https-trust-store-file+`# 

[.options-description]#The trust store which holds the certificate information of the certificates to trust.#

[#option-extended-https-trust-store-file,role="options-extended"]
--


*CLI:* `+--https-trust-store-file+` +
*Env:* `+KC_HTTPS_TRUST_STORE_FILE+`
--



|

|
[.options-key]#`+https-trust-store-password+`# 

[.options-description]#The password of the trust store file.#

[#option-extended-https-trust-store-password,role="options-extended"]
--


*CLI:* `+--https-trust-store-password+` +
*Env:* `+KC_HTTPS_TRUST_STORE_PASSWORD+`
--



|

|
[.options-key]#`+https-trust-store-type+`# 

[.options-description]#The type of the trust store file.#

[#option-extended-https-trust-store-type,role="options-extended"]
--
[.options-description-extended]#If not given, the type is automatically detected based on the file extension. If `fips-mode` is set to `strict` and no value is set, it defaults to `BCFKS`.#

*CLI:* `+--https-trust-store-type+` +
*Env:* `+KC_HTTPS_TRUST_STORE_TYPE+`
--



|


|===
[#category-health]
== Health

[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+health-enabled+`# [.none]#icon:tools[role=options-build]#

[.options-description]#If the server should expose health check endpoints.#

[#option-extended-health-enabled,role="options-extended"]
--
[.options-description-extended]#If enabled, health checks are available at the `/health`, `/health/ready` and `/health/live` endpoints.#

*CLI:* `+--health-enabled+` +
*Env:* `+KC_HEALTH_ENABLED+`
--



|
`+true+`, `+false+` (default)


|===
[#category-management]
== Management

[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+http-management-port+`# 

[.options-description]#Port of the management interface.#

[#option-extended-http-management-port,role="options-extended"]
--
[.options-description-extended]#Relevant only when something is exposed on the management interface - see the guide for details.#

*CLI:* `+--http-management-port+` +
*Env:* `+KC_HTTP_MANAGEMENT_PORT+`
--



|[.options-default]#`+9000+`# (default)

|
[.options-key]#`+http-management-relative-path+`# [.none]#icon:tools[role=options-build]#

[.options-description]#Set the path relative to `/` for serving resources from management interface.#

[#option-extended-http-management-relative-path,role="options-extended"]
--
[.options-description-extended]#The path must start with a `/`. If not given, the value is inherited from HTTP options. Relevant only when something is exposed on the management interface - see the guide for details.#

*CLI:* `+--http-management-relative-path+` +
*Env:* `+KC_HTTP_MANAGEMENT_RELATIVE_PATH+`
--



|[.options-default]#`+/+`# (default)

|
[.options-key]#`+https-management-certificate-file+`# 

[.options-description]#The file path to a server certificate or certificate chain in PEM format for the management server.#

[#option-extended-https-management-certificate-file,role="options-extended"]
--
[.options-description-extended]#If not given, the value is inherited from HTTP options. Relevant only when something is exposed on the management interface - see the guide for details.#

*CLI:* `+--https-management-certificate-file+` +
*Env:* `+KC_HTTPS_MANAGEMENT_CERTIFICATE_FILE+`
--



|

|
[.options-key]#`+https-management-certificate-key-file+`# 

[.options-description]#The file path to a private key in PEM format for the management server.#

[#option-extended-https-management-certificate-key-file,role="options-extended"]
--
[.options-description-extended]#If not given, the value is inherited from HTTP options. Relevant only when something is exposed on the management interface - see the guide for details.#

*CLI:* `+--https-management-certificate-key-file+` +
*Env:* `+KC_HTTPS_MANAGEMENT_CERTIFICATE_KEY_FILE+`
--



|

|
[.options-key]#`+https-management-certificates-reload-period+`# 

[.options-description]#Interval on which to reload key store, trust store, and certificate files referenced by https-management-* options for the management server.#

[#option-extended-https-management-certificates-reload-period,role="options-extended"]
--
[.options-description-extended]#May be a java.time.Duration value, an integer number of seconds, or an integer followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1 to disable. If not given, the value is inherited from HTTP options. Relevant only when something is exposed on the management interface - see the guide for details.#

*CLI:* `+--https-management-certificates-reload-period+` +
*Env:* `+KC_HTTPS_MANAGEMENT_CERTIFICATES_RELOAD_PERIOD+`
--



|[.options-default]#`+1h+`# (default)

|
[.options-key]#`+https-management-client-auth+`# [.none]#icon:tools[role=options-build]#

[.options-description]#Configures the management interface to require/request client authentication.#

[#option-extended-https-management-client-auth,role="options-extended"]
--
[.options-description-extended]#If not given, the value is inherited from HTTP options. Relevant only when something is exposed on the management interface - see the guide for details.#

*CLI:* `+--https-management-client-auth+` +
*Env:* `+KC_HTTPS_MANAGEMENT_CLIENT_AUTH+`
--



|
`+none+` (default), `+request+`, `+required+`

|
[.options-key]#`+https-management-key-store-file+`# 

[.options-description]#The key store which holds the certificate information instead of specifying separate files for the management server.#

[#option-extended-https-management-key-store-file,role="options-extended"]
--
[.options-description-extended]#If not given, the value is inherited from HTTP options. Relevant only when something is exposed on the management interface - see the guide for details.#

*CLI:* `+--https-management-key-store-file+` +
*Env:* `+KC_HTTPS_MANAGEMENT_KEY_STORE_FILE+`
--



|

|
[.options-key]#`+https-management-key-store-password+`# 

[.options-description]#The password of the key store file for the management server.#

[#option-extended-https-management-key-store-password,role="options-extended"]
--
[.options-description-extended]#If not given, the value is inherited from HTTP options. Relevant only when something is exposed on the management interface - see the guide for details.#

*CLI:* `+--https-management-key-store-password+` +
*Env:* `+KC_HTTPS_MANAGEMENT_KEY_STORE_PASSWORD+`
--



|[.options-default]#`+password+`# (default)

|
[.options-key]#`+legacy-observability-interface+`# [.none]#icon:tools[role=options-build]#

[.options-description]#If metrics/health endpoints should be exposed on the main HTTP server (not recommended).#

[#option-extended-legacy-observability-interface,role="options-extended"]
--
[.options-description-extended]#If set to true, the management interface is disabled.#

*CLI:* `+--legacy-observability-interface+` +
*Env:* `+KC_LEGACY_OBSERVABILITY_INTERFACE+`
--


*DEPRECATED.*


|
`+true+`, `+false+` (default)


|===
[#category-metrics]
== Metrics

[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+metrics-enabled+`# [.none]#icon:tools[role=options-build]#

[.options-description]#If the server should expose metrics.#

[#option-extended-metrics-enabled,role="options-extended"]
--
[.options-description-extended]#If enabled, metrics are available at the `/metrics` endpoint.#

*CLI:* `+--metrics-enabled+` +
*Env:* `+KC_METRICS_ENABLED+`
--



|
`+true+`, `+false+` (default)


|===
[#category-proxy]
== Proxy

[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+proxy-headers+`# 

[.options-description]#The proxy headers that should be accepted by the server.#

[#option-extended-proxy-headers,role="options-extended"]
--
[.options-description-extended]#Misconfiguration might leave the server exposed to security vulnerabilities. Takes precedence over the deprecated proxy option.#

*CLI:* `+--proxy-headers+` +
*Env:* `+KC_PROXY_HEADERS+`
--



|
`+forwarded+`, `+xforwarded+`

|
[.options-key]#`+proxy-protocol-enabled+`# 

[.options-description]#Whether the server should use the HA PROXY protocol when serving requests from behind a proxy.#

[#option-extended-proxy-protocol-enabled,role="options-extended"]
--
[.options-description-extended]#When set to true, the remote address returned will be the one from the actual connecting client. Cannot be enabled when the `proxy-headers` is used.#

*CLI:* `+--proxy-protocol-enabled+` +
*Env:* `+KC_PROXY_PROTOCOL_ENABLED+`
--



|
`+true+`, `+false+` (default)

|
[.options-key]#`+proxy-trusted-addresses+`# 

[.options-description]#A comma separated list of trusted proxy addresses.#

[#option-extended-proxy-trusted-addresses,role="options-extended"]
--
[.options-description-extended]#If set, then proxy headers from other addresses will be ignored. By default all addresses are trusted. A trusted proxy address is specified as an IP address (IPv4 or IPv6) or Classless Inter-Domain Routing (CIDR) notation. Available only when proxy-headers is set.#

*CLI:* `+--proxy-trusted-addresses+` +
*Env:* `+KC_PROXY_TRUSTED_ADDRESSES+`
--



|


|===
[#category-vault]
== Vault

[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+vault+`# [.none]#icon:tools[role=options-build]#

[.options-description]#Enables a vault provider.#

[#option-extended-vault,role="options-extended"]
--


*CLI:* `+--vault+` +
*Env:* `+KC_VAULT+`
--



|
`+file+`, `+keystore+`

|
[.options-key]#`+vault-dir+`# 

[.options-description]#If set, secrets can be obtained by reading the content of files within the given directory.#

[#option-extended-vault-dir,role="options-extended"]
--


*CLI:* `+--vault-dir+` +
*Env:* `+KC_VAULT_DIR+`
--



|

|
[.options-key]#`+vault-file+`# 

[.options-description]#Path to the keystore file.#

[#option-extended-vault-file,role="options-extended"]
--


*CLI:* `+--vault-file+` +
*Env:* `+KC_VAULT_FILE+`
--



|

|
[.options-key]#`+vault-pass+`# 

[.options-description]#Password for the vault keystore.#

[#option-extended-vault-pass,role="options-extended"]
--


*CLI:* `+--vault-pass+` +
*Env:* `+KC_VAULT_PASS+`
--



|

|
[.options-key]#`+vault-type+`# 

[.options-description]#Specifies the type of the keystore file.#

[#option-extended-vault-type,role="options-extended"]
--


*CLI:* `+--vault-type+` +
*Env:* `+KC_VAULT_TYPE+`
--



|[.options-default]#`+PKCS12+`# (default)


|===
[#category-logging]
== Logging

[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+log+`# 

[.options-description]#Enable one or more log handlers in a comma-separated list.#

[#option-extended-log,role="options-extended"]
--


*CLI:* `+--log+` +
*Env:* `+KC_LOG+`
--



|
`+console+`, `+file+`, `+syslog+`

|
[.options-key]#`+log-async+`# 

[.options-description]#Indicates whether to log asynchronously to all handlers.#

[#option-extended-log-async,role="options-extended"]
--


*CLI:* `+--log-async+` +
*Env:* `+KC_LOG_ASYNC+`
--



|
`+true+`, `+false+` (default)

|
[.options-key]#`+log-console-async+`# 

[.options-description]#Indicates whether to log asynchronously to console.#

[#option-extended-log-console-async,role="options-extended"]
--
[.options-description-extended]#If not set, value from the parent property `log-async` is used.#

*CLI:* `+--log-console-async+` +
*Env:* `+KC_LOG_CONSOLE_ASYNC+`
--

Available only when Console log handler is activated


|
`+true+`, `+false+` (default)

|
[.options-key]#`+log-console-async-queue-length+`# 

[.options-description]#The queue length to use before flushing writing when logging to console.#

[#option-extended-log-console-async-queue-length,role="options-extended"]
--


*CLI:* `+--log-console-async-queue-length+` +
*Env:* `+KC_LOG_CONSOLE_ASYNC_QUEUE_LENGTH+`
--

Available only when Console log handler is activated and asynchronous logging is enabled


|[.options-default]#`+512+`# (default)

|
[.options-key]#`+log-console-color+`# 

[.options-description]#Enable or disable colors when logging to console.#

[#option-extended-log-console-color,role="options-extended"]
--


*CLI:* `+--log-console-color+` +
*Env:* `+KC_LOG_CONSOLE_COLOR+`
--

Available only when Console log handler is activated


|
`+true+`, `+false+` (default)

|
[.options-key]#`+log-console-format+`# 

[.options-description]#The format of unstructured console log entries.#

[#option-extended-log-console-format,role="options-extended"]
--
[.options-description-extended]#If the format has spaces in it, escape the value using "<format>".#

*CLI:* `+--log-console-format+` +
*Env:* `+KC_LOG_CONSOLE_FORMAT+`
--

Available only when Console log handler is activated


|[.options-default]#`+%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n+`# (default)

|
[.options-key]#`+log-console-include-trace+`# 

[.options-description]#Include tracing information in the console log.#

[#option-extended-log-console-include-trace,role="options-extended"]
--
[.options-description-extended]#If the `log-console-format` option is specified, this option has no effect.#

*CLI:* `+--log-console-include-trace+` +
*Env:* `+KC_LOG_CONSOLE_INCLUDE_TRACE+`
--

Available only when Console log handler and Tracing is activated


|
`+true+` (default), `+false+`

|
[.options-key]#`+log-console-json-format+`# 

[.options-description]#Set the format of the produced JSON.#

[#option-extended-log-console-json-format,role="options-extended"]
--


*CLI:* `+--log-console-json-format+` +
*Env:* `+KC_LOG_CONSOLE_JSON_FORMAT+`
--

Available only when Console log handler is activated and output is set to 'json'


|
`+default+` (default), `+ecs+`

|
[.options-key]#`+log-console-level+`# 

[.options-description]#Set the log level for the console handler.#

[#option-extended-log-console-level,role="options-extended"]
--
[.options-description-extended]#It specifies the most verbose log level for logs shown in the output. It respects levels specified in the `log-level` option, which represents the maximal verbosity for the whole logging system. For more information, check the Logging guide.#

*CLI:* `+--log-console-level+` +
*Env:* `+KC_LOG_CONSOLE_LEVEL+`
--

Available only when Console log handler is activated


|
`+off+`, `+fatal+`, `+error+`, `+warn+`, `+info+`, `+debug+`, `+trace+`, `+all+` (default)

|
[.options-key]#`+log-console-output+`# 

[.options-description]#Set the log output to JSON or default (plain) unstructured logging.#

[#option-extended-log-console-output,role="options-extended"]
--


*CLI:* `+--log-console-output+` +
*Env:* `+KC_LOG_CONSOLE_OUTPUT+`
--

Available only when Console log handler is activated


|
`+default+` (default), `+json+`

|
[.options-key]#`+log-file+`# 

[.options-description]#Set the log file path and filename.#

[#option-extended-log-file,role="options-extended"]
--


*CLI:* `+--log-file+` +
*Env:* `+KC_LOG_FILE+`
--

Available only when File log handler is activated


|[.options-default]#`+data/log/keycloak.log+`# (default)

|
[.options-key]#`+log-file-async+`# 

[.options-description]#Indicates whether to log asynchronously to file log.#

[#option-extended-log-file-async,role="options-extended"]
--
[.options-description-extended]#If not set, value from the parent property `log-async` is used.#

*CLI:* `+--log-file-async+` +
*Env:* `+KC_LOG_FILE_ASYNC+`
--

Available only when File log handler is activated


|
`+true+`, `+false+` (default)

|
[.options-key]#`+log-file-async-queue-length+`# 

[.options-description]#The queue length to use before flushing writing when logging to file log.#

[#option-extended-log-file-async-queue-length,role="options-extended"]
--


*CLI:* `+--log-file-async-queue-length+` +
*Env:* `+KC_LOG_FILE_ASYNC_QUEUE_LENGTH+`
--

Available only when File log handler is activated and asynchronous logging is enabled


|[.options-default]#`+512+`# (default)

|
[.options-key]#`+log-file-format+`# 

[.options-description]#Set a format specific to file log entries.#

[#option-extended-log-file-format,role="options-extended"]
--


*CLI:* `+--log-file-format+` +
*Env:* `+KC_LOG_FILE_FORMAT+`
--

Available only when File log handler is activated


|[.options-default]#`+%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n+`# (default)

|
[.options-key]#`+log-file-include-trace+`# 

[.options-description]#Include tracing information in the file log.#

[#option-extended-log-file-include-trace,role="options-extended"]
--
[.options-description-extended]#If the `log-file-format` option is specified, this option has no effect.#

*CLI:* `+--log-file-include-trace+` +
*Env:* `+KC_LOG_FILE_INCLUDE_TRACE+`
--

Available only when File log handler and Tracing is activated


|
`+true+` (default), `+false+`

|
[.options-key]#`+log-file-json-format+`# 

[.options-description]#Set the format of the produced JSON.#

[#option-extended-log-file-json-format,role="options-extended"]
--


*CLI:* `+--log-file-json-format+` +
*Env:* `+KC_LOG_FILE_JSON_FORMAT+`
--

Available only when File log handler is activated and output is set to 'json'


|
`+default+` (default), `+ecs+`

|
[.options-key]#`+log-file-level+`# 

[.options-description]#Set the log level for the file handler.#

[#option-extended-log-file-level,role="options-extended"]
--
[.options-description-extended]#It specifies the most verbose log level for logs shown in the output. It respects levels specified in the `log-level` option, which represents the maximal verbosity for the whole logging system. For more information, check the Logging guide.#

*CLI:* `+--log-file-level+` +
*Env:* `+KC_LOG_FILE_LEVEL+`
--

Available only when File log handler is activated


|
`+off+`, `+fatal+`, `+error+`, `+warn+`, `+info+`, `+debug+`, `+trace+`, `+all+` (default)

|
[.options-key]#`+log-file-output+`# 

[.options-description]#Set the log output to JSON or default (plain) unstructured logging.#

[#option-extended-log-file-output,role="options-extended"]
--


*CLI:* `+--log-file-output+` +
*Env:* `+KC_LOG_FILE_OUTPUT+`
--

Available only when File log handler is activated


|
`+default+` (default), `+json+`

|
[.options-key]#`+log-level+`# 

[.options-description]#The log level of the root category or a comma-separated list of individual categories and their levels.#

[#option-extended-log-level,role="options-extended"]
--
[.options-description-extended]#For the root category, you don't need to specify a category.#

*CLI:* `+--log-level+` +
*Env:* `+KC_LOG_LEVEL+`
--



|[.options-default]#`+[info]+`# (default)

|
[.options-key]#`+log-syslog-app-name+`# 

[.options-description]#Set the app name used when formatting the message in RFC5424 format.#

[#option-extended-log-syslog-app-name,role="options-extended"]
--


*CLI:* `+--log-syslog-app-name+` +
*Env:* `+KC_LOG_SYSLOG_APP_NAME+`
--

Available only when Syslog is activated


|[.options-default]#`+keycloak+`# (default)

|
[.options-key]#`+log-syslog-async+`# 

[.options-description]#Indicates whether to log asynchronously to Syslog.#

[#option-extended-log-syslog-async,role="options-extended"]
--
[.options-description-extended]#If not set, value from the parent property `log-async` is used.#

*CLI:* `+--log-syslog-async+` +
*Env:* `+KC_LOG_SYSLOG_ASYNC+`
--

Available only when Syslog is activated


|
`+true+`, `+false+` (default)

|
[.options-key]#`+log-syslog-async-queue-length+`# 

[.options-description]#The queue length to use before flushing writing when logging to Syslog.#

[#option-extended-log-syslog-async-queue-length,role="options-extended"]
--


*CLI:* `+--log-syslog-async-queue-length+` +
*Env:* `+KC_LOG_SYSLOG_ASYNC_QUEUE_LENGTH+`
--

Available only when Syslog is activated and asynchronous logging is enabled


|[.options-default]#`+512+`# (default)

|
[.options-key]#`+log-syslog-counting-framing+`# 

[.options-description]#If `true`, the message being sent is prefixed with the size of the message.#

[#option-extended-log-syslog-counting-framing,role="options-extended"]
--
[.options-description-extended]#If `protocol-dependent`, the default value is `true` when `log-syslog-protocol` is `tcp` or `ssl-tcp`, otherwise `false`.#

*CLI:* `+--log-syslog-counting-framing+` +
*Env:* `+KC_LOG_SYSLOG_COUNTING_FRAMING+`
--

Available only when Syslog is activated


|
`+true+`, `+false+`, `+protocol-dependent+` (default)

|
[.options-key]#`+log-syslog-endpoint+`# 

[.options-description]#Set the IP address and port of the Syslog server.#

[#option-extended-log-syslog-endpoint,role="options-extended"]
--


*CLI:* `+--log-syslog-endpoint+` +
*Env:* `+KC_LOG_SYSLOG_ENDPOINT+`
--

Available only when Syslog is activated


|[.options-default]#`+localhost:514+`# (default)

|
[.options-key]#`+log-syslog-format+`# 

[.options-description]#Set a format specific to Syslog entries.#

[#option-extended-log-syslog-format,role="options-extended"]
--


*CLI:* `+--log-syslog-format+` +
*Env:* `+KC_LOG_SYSLOG_FORMAT+`
--

Available only when Syslog is activated


|[.options-default]#`+%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c] (%t) %s%e%n+`# (default)

|
[.options-key]#`+log-syslog-include-trace+`# 

[.options-description]#Include tracing information in the Syslog.#

[#option-extended-log-syslog-include-trace,role="options-extended"]
--
[.options-description-extended]#If the `log-syslog-format` option is specified, this option has no effect.#

*CLI:* `+--log-syslog-include-trace+` +
*Env:* `+KC_LOG_SYSLOG_INCLUDE_TRACE+`
--

Available only when Syslog handler and Tracing is activated


|
`+true+` (default), `+false+`

|
[.options-key]#`+log-syslog-json-format+`# 

[.options-description]#Set the format of the produced JSON.#

[#option-extended-log-syslog-json-format,role="options-extended"]
--


*CLI:* `+--log-syslog-json-format+` +
*Env:* `+KC_LOG_SYSLOG_JSON_FORMAT+`
--

Available only when Syslog is activated and output is set to 'json'


|
`+default+` (default), `+ecs+`

|
[.options-key]#`+log-syslog-level+`# 

[.options-description]#Set the log level for the Syslog handler.#

[#option-extended-log-syslog-level,role="options-extended"]
--
[.options-description-extended]#It specifies the most verbose log level for logs shown in the output. It respects levels specified in the `log-level` option, which represents the maximal verbosity for the whole logging system. For more information, check the Logging guide.#

*CLI:* `+--log-syslog-level+` +
*Env:* `+KC_LOG_SYSLOG_LEVEL+`
--

Available only when Syslog is activated


|
`+off+`, `+fatal+`, `+error+`, `+warn+`, `+info+`, `+debug+`, `+trace+`, `+all+` (default)

|
[.options-key]#`+log-syslog-max-length+`# 

[.options-description]#Set the maximum length, in bytes, of the message allowed to be sent.#

[#option-extended-log-syslog-max-length,role="options-extended"]
--
[.options-description-extended]#The length includes the header and the message. If not set, the default value is 2048 when `log-syslog-type` is rfc5424 (default) and 1024 when `log-syslog-type` is rfc3164.#

*CLI:* `+--log-syslog-max-length+` +
*Env:* `+KC_LOG_SYSLOG_MAX_LENGTH+`
--

Available only when Syslog is activated


|

|
[.options-key]#`+log-syslog-output+`# 

[.options-description]#Set the Syslog output to JSON or default (plain) unstructured logging.#

[#option-extended-log-syslog-output,role="options-extended"]
--


*CLI:* `+--log-syslog-output+` +
*Env:* `+KC_LOG_SYSLOG_OUTPUT+`
--

Available only when Syslog is activated


|
`+default+` (default), `+json+`

|
[.options-key]#`+log-syslog-protocol+`# 

[.options-description]#Set the protocol used to connect to the Syslog server.#

[#option-extended-log-syslog-protocol,role="options-extended"]
--


*CLI:* `+--log-syslog-protocol+` +
*Env:* `+KC_LOG_SYSLOG_PROTOCOL+`
--

Available only when Syslog is activated


|
`+tcp+` (default), `+udp+`, `+ssl-tcp+`

|
[.options-key]#`+log-syslog-type+`# 

[.options-description]#Set the Syslog type used to format the sent message.#

[#option-extended-log-syslog-type,role="options-extended"]
--


*CLI:* `+--log-syslog-type+` +
*Env:* `+KC_LOG_SYSLOG_TYPE+`
--

Available only when Syslog is activated


|
`+rfc5424+` (default), `+rfc3164+`


|===
[#category-tracing]
== Tracing

[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+tracing-compression+`# 

[.options-description]#OpenTelemetry compression method used to compress payloads.#

[#option-extended-tracing-compression,role="options-extended"]
--
[.options-description-extended]#If unset, compression is disabled.#

*CLI:* `+--tracing-compression+` +
*Env:* `+KC_TRACING_COMPRESSION+`
--

Available only when Tracing is enabled


|
`+gzip+`, `+none+` (default)

|
[.options-key]#`+tracing-enabled+`# [.none]#icon:tools[role=options-build]#

[.options-description]#Enables the OpenTelemetry tracing.#

[#option-extended-tracing-enabled,role="options-extended"]
--


*CLI:* `+--tracing-enabled+` +
*Env:* `+KC_TRACING_ENABLED+`
--

Available only when 'opentelemetry' feature is enabled


|
`+true+`, `+false+` (default)

|
[.options-key]#`+tracing-endpoint+`# 

[.options-description]#OpenTelemetry endpoint to connect to.#

[#option-extended-tracing-endpoint,role="options-extended"]
--


*CLI:* `+--tracing-endpoint+` +
*Env:* `+KC_TRACING_ENDPOINT+`
--

Available only when Tracing is enabled


|[.options-default]#`+http://localhost:4317+`# (default)

|
[.options-key]#`+tracing-jdbc-enabled+`# [.none]#icon:tools[role=options-build]#

[.options-description]#Enables the OpenTelemetry JDBC tracing.#

[#option-extended-tracing-jdbc-enabled,role="options-extended"]
--


*CLI:* `+--tracing-jdbc-enabled+` +
*Env:* `+KC_TRACING_JDBC_ENABLED+`
--

Available only when Tracing is enabled


|
`+true+` (default), `+false+`

|
[.options-key]#`+tracing-protocol+`# 

[.options-description]#OpenTelemetry protocol used for the telemetry data.#

[#option-extended-tracing-protocol,role="options-extended"]
--


*CLI:* `+--tracing-protocol+` +
*Env:* `+KC_TRACING_PROTOCOL+`
--

Available only when Tracing is enabled


|
`+grpc+` (default), `+http/protobuf+`

|
[.options-key]#`+tracing-resource-attributes+`# 

[.options-description]#OpenTelemetry resource attributes present in the exported trace to characterize the telemetry producer.#

[#option-extended-tracing-resource-attributes,role="options-extended"]
--
[.options-description-extended]#Values in format `key1=val1,key2=val2`. For more information, check the Tracing guide.#

*CLI:* `+--tracing-resource-attributes+` +
*Env:* `+KC_TRACING_RESOURCE_ATTRIBUTES+`
--

Available only when Tracing is enabled


|

|
[.options-key]#`+tracing-sampler-ratio+`# 

[.options-description]#OpenTelemetry sampler ratio.#

[#option-extended-tracing-sampler-ratio,role="options-extended"]
--
[.options-description-extended]#Probability that a span will be sampled. Expected double value in interval [0,1].#

*CLI:* `+--tracing-sampler-ratio+` +
*Env:* `+KC_TRACING_SAMPLER_RATIO+`
--

Available only when Tracing is enabled


|[.options-default]#`+1.0+`# (default)

|
[.options-key]#`+tracing-sampler-type+`# [.none]#icon:tools[role=options-build]#

[.options-description]#OpenTelemetry sampler to use for tracing.#

[#option-extended-tracing-sampler-type,role="options-extended"]
--


*CLI:* `+--tracing-sampler-type+` +
*Env:* `+KC_TRACING_SAMPLER_TYPE+`
--

Available only when Tracing is enabled


|
`+always_on+`, `+always_off+`, `+traceidratio+` (default), `+parentbased_always_on+`, `+parentbased_always_off+`, `+parentbased_traceidratio+`

|
[.options-key]#`+tracing-service-name+`# 

[.options-description]#OpenTelemetry service name.#

[#option-extended-tracing-service-name,role="options-extended"]
--
[.options-description-extended]#Takes precedence over `service.name` defined in the `tracing-resource-attributes` property.#

*CLI:* `+--tracing-service-name+` +
*Env:* `+KC_TRACING_SERVICE_NAME+`
--

Available only when Tracing is enabled


|[.options-default]#`+keycloak+`# (default)


|===
[#category-events]
== Events

[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+event-metrics-user-enabled+`# [.none]#icon:tools[role=options-build]#

[.options-description]#Create metrics based on user events.#

[#option-extended-event-metrics-user-enabled,role="options-extended"]
--


*CLI:* `+--event-metrics-user-enabled+` +
*Env:* `+KC_EVENT_METRICS_USER_ENABLED+`
--

Available only when metrics are enabled and feature user-event-metrics is enabled


|
`+true+`, `+false+` (default)

|
[.options-key]#`+event-metrics-user-events+`# 

[.options-description]#Comma-separated list of events to be collected for user event metrics.#

[#option-extended-event-metrics-user-events,role="options-extended"]
--
[.options-description-extended]#This option can be used to reduce the number of metrics created as by default all user events create a metric.#

*CLI:* `+--event-metrics-user-events+` +
*Env:* `+KC_EVENT_METRICS_USER_EVENTS+`
--

Available only when user event metrics are enabled

Use `remove_credential` instead of `remove_totp`, and `update_credential` instead of `update_totp` and `update_password`.
*Deprecated values: `+remove_totp+`, `+update_totp+`, `+update_password+`*

|
`+authreqid_to_token+`, `+client_delete+`, `+client_info+`, `+client_initiated_account_linking+`, `+client_login+`, `+client_register+`, `+client_update+`, `+code_to_token+`, `+custom_required_action+`, `+delete_account+`, `+execute_action_token+`, `+execute_actions+`, `+federated_identity_link+`, `+federated_identity_override_link+`, `+grant_consent+`, `+identity_provider_first_login+`, `+identity_provider_link_account+`, `+identity_provider_login+`, `+identity_provider_post_login+`, `+identity_provider_response+`, `+identity_provider_retrieve_token+`, `+impersonate+`, `+introspect_token+`, `+invalid_signature+`, `+invite_org+`, `+login+`, `+logout+`, `+oauth2_device_auth+`, `+oauth2_device_code_to_token+`, `+oauth2_device_verify_user_code+`, `+oauth2_extension_grant+`, `+permission_token+`, `+pushed_authorization_request+`, `+refresh_token+`, `+register+`, `+register_node+`, `+remove_credential+`, `+remove_federated_identity+`, `+remove_totp+` (deprecated), `+reset_password+`, `+restart_authentication+`, `+revoke_grant+`, `+send_identity_provider_link+`, `+send_reset_password+`, `+send_verify_email+`, `+token_exchange+`, `+unregister_node+`, `+update_consent+`, `+update_credential+`, `+update_email+`, `+update_password+` (deprecated), `+update_profile+`, `+update_totp+` (deprecated), `+user_disabled_by_permanent_lockout+`, `+user_disabled_by_temporary_lockout+`, `+user_info_request+`, `+verify_email+`, `+verify_profile+`

|
[.options-key]#`+event-metrics-user-tags+`# 

[.options-description]#Comma-separated list of tags to be collected for user event metrics.#

[#option-extended-event-metrics-user-tags,role="options-extended"]
--
[.options-description-extended]#By default only `realm` is enabled to avoid a high metrics cardinality.#

*CLI:* `+--event-metrics-user-tags+` +
*Env:* `+KC_EVENT_METRICS_USER_TAGS+`
--

Available only when user event metrics are enabled


|
`+realm+`, `+idp+`, `+clientId+`


|===
[#category-truststore]
== Truststore

[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+tls-hostname-verifier+`# 

[.options-description]#The TLS hostname verification policy for out-going HTTPS and SMTP requests.#

[#option-extended-tls-hostname-verifier,role="options-extended"]
--
[.options-description-extended]#ANY should not be used in production.#

*CLI:* `+--tls-hostname-verifier+` +
*Env:* `+KC_TLS_HOSTNAME_VERIFIER+`
--


STRICT and WILDCARD have been deprecated, use DEFAULT instead.
*Deprecated values: `+STRICT+`, `+WILDCARD+`*

|
`+ANY+`, `+WILDCARD+` (deprecated), `+STRICT+` (deprecated), `+DEFAULT+` (default)

|
[.options-key]#`+truststore-paths+`# 

[.options-description]#List of pkcs12 (p12, pfx, or pkcs12 file extensions), PEM files, or directories containing those files that will be used as a system truststore.#

[#option-extended-truststore-paths,role="options-extended"]
--


*CLI:* `+--truststore-paths+` +
*Env:* `+KC_TRUSTSTORE_PATHS+`
--



|


|===
[#category-security]
== Security

[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+fips-mode+`# [.none]#icon:tools[role=options-build]#

[.options-description]#Sets the FIPS mode.#

[#option-extended-fips-mode,role="options-extended"]
--
[.options-description-extended]#If `non-strict` is set, FIPS is enabled but on non-approved mode. For full FIPS compliance, set `strict` to run on approved mode. This option defaults to `disabled` when `fips` feature is disabled, which is by default. This option defaults to `non-strict` when `fips` feature is enabled.#

*CLI:* `+--fips-mode+` +
*Env:* `+KC_FIPS_MODE+`
--



|
`+non-strict+`, `+strict+`


|===
[#category-export]
== Export

[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+dir+`# 

[.options-description]#Set the path to a directory where files will be created with the exported data.#

[#option-extended-dir,role="options-extended"]
--


*CLI:* `+--dir+` +
*Env:* `+KC_DIR+`
--



|

|
[.options-key]#`+file+`# 

[.options-description]#Set the path to a file that will be created with the exported data.#

[#option-extended-file,role="options-extended"]
--
[.options-description-extended]#To export more than 500 users, export to a directory with different files instead.#

*CLI:* `+--file+` +
*Env:* `+KC_FILE+`
--



|

|
[.options-key]#`+realm+`# 

[.options-description]#Set the name of the realm to export.#

[#option-extended-realm,role="options-extended"]
--
[.options-description-extended]#If not set, all realms are going to be exported.#

*CLI:* `+--realm+` +
*Env:* `+KC_REALM+`
--



|

|
[.options-key]#`+users+`# 

[.options-description]#Set how users should be exported.#

[#option-extended-users,role="options-extended"]
--


*CLI:* `+--users+` +
*Env:* `+KC_USERS+`
--



|
`+skip+`, `+realm_file+`, `+same_file+`, `+different_files+` (default)

|
[.options-key]#`+users-per-file+`# 

[.options-description]#Set the number of users per file.#

[#option-extended-users-per-file,role="options-extended"]
--
[.options-description-extended]#It is used only if `users` is set to `different_files`. Increasing this number leads to exponentially increasing export times.#

*CLI:* `+--users-per-file+` +
*Env:* `+KC_USERS_PER_FILE+`
--



|[.options-default]#`+50+`# (default)


|===
[#category-import]
== Import

[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+dir+`# 

[.options-description]#Set the path to a directory where files will be read from.#

[#option-extended-dir,role="options-extended"]
--


*CLI:* `+--dir+` +
*Env:* `+KC_DIR+`
--



|

|
[.options-key]#`+file+`# 

[.options-description]#Set the path to a file that will be read.#

[#option-extended-file,role="options-extended"]
--


*CLI:* `+--file+` +
*Env:* `+KC_FILE+`
--



|

|
[.options-key]#`+override+`# 

[.options-description]#Set if existing data should be overwritten.#

[#option-extended-override,role="options-extended"]
--
[.options-description-extended]#If set to false, data will be ignored.#

*CLI:* `+--override+` +
*Env:* `+KC_OVERRIDE+`
--



|
`+true+` (default), `+false+`


|===
[#category-bootstrap_admin]
== Bootstrap Admin

[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+bootstrap-admin-client-id+`# 

[.options-description]#Client id for the temporary bootstrap admin service account.#

[#option-extended-bootstrap-admin-client-id,role="options-extended"]
--
[.options-description-extended]#Used only when the master realm is created. Available only when bootstrap admin client secret is set.#

*CLI:* `+--bootstrap-admin-client-id+` +
*Env:* `+KC_BOOTSTRAP_ADMIN_CLIENT_ID+`
--



|[.options-default]#`+temp-admin+`# (default)

|
[.options-key]#`+bootstrap-admin-client-secret+`# 

[.options-description]#Client secret for the temporary bootstrap admin service account.#

[#option-extended-bootstrap-admin-client-secret,role="options-extended"]
--
[.options-description-extended]#Used only when the master realm is created. Use a non-CLI configuration option for this option if possible.#

*CLI:* `+--bootstrap-admin-client-secret+` +
*Env:* `+KC_BOOTSTRAP_ADMIN_CLIENT_SECRET+`
--



|

|
[.options-key]#`+bootstrap-admin-password+`# 

[.options-description]#Temporary bootstrap admin password.#

[#option-extended-bootstrap-admin-password,role="options-extended"]
--
[.options-description-extended]#Used only when the master realm is created. Use a non-CLI configuration option for this option if possible.#

*CLI:* `+--bootstrap-admin-password+` +
*Env:* `+KC_BOOTSTRAP_ADMIN_PASSWORD+`
--



|

|
[.options-key]#`+bootstrap-admin-username+`# 

[.options-description]#Temporary bootstrap admin username.#

[#option-extended-bootstrap-admin-username,role="options-extended"]
--
[.options-description-extended]#Used only when the master realm is created. Available only when bootstrap admin password is set.#

*CLI:* `+--bootstrap-admin-username+` +
*Env:* `+KC_BOOTSTRAP_ADMIN_USERNAME+`
--



|[.options-default]#`+temp-admin+`# (default)


|===

