Keycloak: Automate with the CLI

Start Keycloak, retrieve its credentials, and modify its configuration programmatically using the Stackhero CLI

👋 Welcome to the Stackhero documentation!

Stackhero offers a Keycloak cloud service that makes it easy to deploy a production-ready identity provider in just 2 minutes:

Unlimited users, realms, and clients

Supports OpenID Connect, OAuth 2.0, SAML 2.0, social login, LDAP, and Active Directory federation

Custom domain name with integrated HTTPS for secure access (for example, https://login.your-company.com)

Custom themes: easily brand your login pages, account console, and emails with the included online editor

Dedicated email server with SPF, DKIM, and DMARC, so account confirmations and password resets are managed for you

Built-in PostgreSQL database, with the administration console accessible on its own dedicated, closable port

One-click updates keep your system up to date without manual intervention

Spend your time developing, not configuring: you can try Stackhero's Keycloak cloud solution in under 5 minutes.

This guide demonstrates how to create a Keycloak service, read its credentials, and update its configuration entirely via the command line, with no need to click through the dashboard. This approach is ideal for scripts, CI pipelines, and AI agents.

We will use the Stackhero CLI for all operations. If you have not already installed it, you can do so with:

curl -fsSL https://www.stackhero.io/install.sh | sh

1. Authenticate

The simplest way to get started is to log in via your browser. When you run the login command, the CLI opens a web page where you can approve access. No passwords or 2FA codes are entered into the CLI itself.

stackhero login

Once logged in, your credentials are stored locally and will be used automatically by subsequent CLI commands.

For fully automated environments such as scripts or CI pipelines, you may prefer a non-interactive access token. You can create one from your dashboard (Account > Access tokens), then export it as an environment variable. The CLI, as well as any script you run, will automatically detect it.

export STACKHERO_TOKEN="usr-xxxxxx:your-token"

2. Find the Keycloak service store

Next, you will want to list the Keycloak service stores available to your account. The CLI accepts the store name (keycloak) directly, so there is no need to look up or copy any IDs.

# List Keycloak service stores (add --organization if you manage more than one)
stackhero services-store-list --name="keycloak"

You can use the store name keycloak in subsequent commands, or select a specific svs-xxxxxx ID from the list if you prefer.

3. Choose an instance size and a region

# List instance sizes for your service store (use the NAME column for --instance)
stackhero instances-store-list --service-store=keycloak

# List available regions (names such as "europe")
stackhero regions-list

4. Create the service

Below is an example script that creates a stack, adds your Keycloak service to it, waits for it to start, retrieves its configuration (including generated credentials), and then applies a new configuration.

#!/bin/bash
set -e

export STACKHERO_TOKEN="usr-xxxxxx:your-token"

serviceStore="keycloak"   # The Keycloak service store name (see step 2)
instance="..."                # An instance size from step 3
region="europe"               # A region name from step 3

# Create a stack for your service (uses your default organisation; add --organization if needed)
stackId=$(stackhero --format=script stack-create \
  --name="My Keycloak stack")
echo "Stack created: ${stackId}"

# Add Keycloak to the stack (names are resolved automatically)
serviceId=$(stackhero --format=script service-add \
  --stack="My Keycloak stack" \
  --service-store="${serviceStore}" \
  --instance="${instance}" \
  --region="${region}")
echo "Service added: keycloak"

# Wait for the service to be fully operational (this may take a few minutes)
stackhero service-wait-for --service="keycloak"

# Retrieve the service configuration, including generated credentials
stackhero service-configuration-get --service="keycloak" --format=json

5. Retrieve credentials

The service-configuration-get command returns the complete configuration for your service, including automatically generated passwords and connection details. The output is in JSON format, making it easy to use in scripts and automation.

stackhero service-configuration-get --service=svc-xxxxxx --format=json

6. Change the configuration

You can review an example configuration schema and then apply your own settings. When you update the configuration, the service may restart to apply the changes.

# View the configuration schema and an example for your service
stackhero service-configuration-example --service=svc-xxxxxx

# Apply a custom configuration (the service restarts if necessary)
stackhero service-configuration-set \
  --service=svc-xxxxxx \
  --configuration='{ "...": "..." }'

# Wait for the new configuration to be applied
stackhero service-wait-for --service=svc-xxxxxx

That is it. You have now seen the full lifecycle: start a service, retrieve its credentials, and reconfigure it, all in a scriptable, automated manner. To explore further, refer to the full CLI documentation, which also covers the non-interactive STACKHERO_TOKEN authentication demonstrated here.