One API surface, nine languages. A polyglot SDK for Keycloak that covers both Authentication (OIDC / OAuth2) and the Admin REST API — idiomatic in each language, isomorphic across all of them.
English · 한국어
"Polyglot" here means programming languages (Java, Python, Node, Go, C#, PHP, Rust, Ruby, Kotlin) — not natural-language localization (i18n).
| Language | Install (after release) | Example |
|---|---|---|
| Java 21+ | Maven io.github.xzawed:keycloak-sdk |
QuickStart.java |
| Python 3.10+ | pip install keycloak-sdk |
quickstart.py · async |
| Node 22+ (ESM) | npm i @xzawed/keycloak-sdk |
quickstart.ts |
| Go 1.25+ | go get github.com/xzawed/KeyCloakSDK/go |
example_test.go |
| C# / .NET 8+ | dotnet add package Xzawed.Keycloak.Sdk |
getting-started |
| PHP 8.3+ | composer require xzawed/keycloak-sdk |
quickstart.php |
| Rust 1.88+ | cargo add keycloak-sdk |
quickstart.rs |
| Ruby 3.2+ | gem install keycloak-sdk |
quickstart.rb |
| Kotlin 2.4.10+ (JVM) | Gradle io.github.xzawed:keycloak-sdk-kotlin |
quickstart.kt |
⚠️ Not published to public registries yet — every release is human-gated. The commands above show the post-release form. Until then, build from source — see the getting-started guide.
Every language follows the same three-step shape — get a token → verify it → call the Admin API. Here it is in Python:
from keycloak_sdk import KeycloakClient, KeycloakConfig
config = KeycloakConfig(
server_url="https://keycloak.example.com",
realm="my-realm",
client_id="my-client",
client_secret="…", # load from env / a secret manager
)
with KeycloakClient.create(config) as kc:
token = kc.auth.client_credentials_token() # 1. get a token
claims = kc.auth.validate(token.access_token) # 2. verify it (hardened)
users = kc.admin.users.search(first=0, max=10) # 3. call the Admin APIThe same flow in all nine languages, plus async usage, lives in the getting-started guide.
All nine SDKs ship the same hardened JWT validation — not the unsafe library defaults:
- Algorithm pinning (rejects
alg: noneand header-supplied algorithms) - Exact
issmatch ·audcontainment check · mandatoryexp· bounded clock skew - DoS-safe JWKS refetch (rate-limited, refetches only on unresolved key IDs)
Secrets and tokens are masked in logs, TLS verification is on by default, and every SDK hides its underlying library types behind a consistent facade.
All nine SDKs are complete and merged to main. Each one passes real Keycloak 26.6 integration tests and a logic-coverage gate (line ≥ 90% / branch ≥ 85%). The only thing left is publishing to public registries — human-gated (see DEPLOY.md).
| SDK | Tests | Coverage | Notes |
|---|---|---|---|
| Java | 138 | gate 90 / 85 | reference implementation |
| Python | 247 | 100% enforced | sync + async (aio) |
| Node | 81 | line 100 / branch 94 | ESM · async-only |
| Go | 46 | 95% | sync + context.Context |
| C# / .NET | 63 | 97 / 93 | async-first |
| PHP | 71 | 100% | final readonly class |
| Rust | 41 | 95% | edition 2024 · async |
| Ruby | 84 | 100 / 93 | Faraday raw-REST admin |
| Kotlin | 106 | 99 / 86 | coroutines · reuses JVM stack |
Integration tests run on Testcontainers (PHP & Ruby fall back to docker-CLI on Windows). Each SDK's security core was reviewed adversarially — see SECURITY.md. Pre-release hardening (OIDC nonce replay protection, configurable JWT signature algorithms, dependency CVE audits) is applied across all nine SDKs.
- 🚀 Getting started — per-language install, quickstart, async, and compatibility matrix
- 🖥️ Deploying a Keycloak server — the server your SDK connects to (single VM + Docker Compose)
- 🗺️ Language roadmap · 🧩 Add-a-language playbook
- 🧪 Test harness — cross-language conformance, security probes, and scoring against real Keycloak
- 🛠️ Development setup — toolchains for the nine SDKs on a fresh machine (
node scripts/doctor.mjsdiagnoses what's missing) - 🤝 Contributing · 📦 Deploy · 🏗️ Architecture & build (CLAUDE.md)
License: Apache-2.0