kcadm.sh

Start an authenticated session

$ kcadm.sh config credentials --server [host] --realm [realm_name] --user [username] --password [password]

$ kcadm.sh create users -s username=[username] -r [realm_name]

$ kcadm.sh get realms

$ kcadm.sh update realms/[realm_name] -f [path/to/file.json]

kcadm.sh [global-options] <action> [<action-options>] [<args>]

--server, -s <URL>
    Keycloak server base URL (e.g., http://localhost:8080)

--realm, -r <realm>
    Target realm name

--user, -u <user>
    Admin username for authentication

--password <password>
    Admin password (use securely)

--client <clientId>
    Client ID for service account auth

--fields <fields>
    Comma-separated fields to display

--format <format>
    Output format: json, jsonp, xml

--quiet
    Suppress logging to stderr

--profile <profile>
    Load specific config profile

--dir <dir>
    Config directory

The kcadm.sh script is the official command-line interface for administering Keycloak identity and access management servers. It allows users to manage realms, clients, users, roles, groups, sessions, and other resources via REST API calls without a web browser.

Usage typically begins with authentication using kcadm.sh config credentials, specifying server URL, realm, user credentials, and optional client ID. Once configured, commands like get realms, create client, or update user can be executed. It supports JSON/XML output formats, field selection, and scripting for automation.

Ideal for DevOps, CI/CD pipelines, and serverless setups, it simplifies bulk operations and scripting. Requires Java runtime and Keycloak server access. Supports Keycloak's latest versions, including Quarkus distribution.

Requires prior config credentials setup or inline auth flags. Sensitive data like passwords logged if not quiet. Not for production password handling; use tokens. Java 11+ and Keycloak server required.

get realms/users/clients - List resources.
create client/client -r realm -s clientId=myapp - Add client.
update user -r realm -s id=userId -s enabled=false - Modify.

Run kcadm.sh config credentials --server URL --realm master --user admin first, or pass flags each time. Supports OIDC tokens via --token.

Introduced in early Keycloak releases (~2014) as part of JBoss/Keycloak project. Evolved with WildFly to Quarkus migrations (Keycloak 17+). Remains core tool despite REST API growth.

curl(1), jq(1)