Hosted Keycloak, plus the extensions that make it work for SaaS.
Website • Docs • Pricing • Blog • Contact
Phase Two builds on Keycloak, one of the most widely used open source identity and access management systems in the world. Our open source extensions add multi-tenancy, passwordless login, audit logging and webhooks, a self-service admin portal, and more — and we run all of it for you as a managed service.
Tip
Run Keycloak in our cloud, no setup needed. Every Phase Two cluster comes with all of our extensions built in. Try it free with your own cluster →
Keycloak Skills (launch post) teach Claude Code, Cursor and Codex how to configure Keycloak and Phase Two: passwordless login (magic link, email OTP, passkeys), organization-restricted login, corporate SSO by email domain, social and enterprise identity providers, and cluster provisioning. They connect to our hosted MCP server, so your agent can check its work against your live deployment.
# Install the skills (connects to our hosted MCP server)
claude plugin marketplace add p2-inc/keycloak-skills
claude plugin install phasetwo@keycloak-skills
# Or connect to the MCP server directly
claude mcp add --transport http keycloak https://mcp.phasetwo.io/mcpMulti-tenancy and SSO
- Organizations — Single-realm multi-tenancy and role delegation via API.
- IdP Wizards — Identity provider setup wizards so organization admins can configure their own SSO.
- Admin Portal — User self-management for their account and organizations.
Authentication
- Magic Link — Passwordless authentication with links sent by email, plus email OTP.
- Atomic Auth Flows — Config as code to safely update authentication flows.
Events and email
- Events — Audit logging for compliance and webhooks for user and system activity.
- Transactional Email — Send Keycloak's email through a transactional email provider.
Look and feel
- Themes — Easy login UI and email customization, plus Admin UI additions for managing our extensions directly from Keycloak.
Operations
- Redis Cache — Replace Keycloak's Infinispan distributed caches with Redis or Valkey.
- KMS — Keep realm signing keys in a cloud KMS instead of in the database.
Migration
- User Migration — Migrate users from legacy systems as they log in.
- WorkOS Migrator — Move from WorkOS to Keycloak.
- Phase Two enhanced Keycloak — Drop-in replacement for Keycloak with all our extensions (source).
- Keycloak on CockroachDB — Our Keycloak fork with CockroachDB support.
- Terraform provider — Manage Phase Two hosted clusters and realms as code (source).
- Java, JS and Python Phase Two API libraries.
- Keycloak theme template and email theme template.
- Framework examples for securing apps.
We sponsor Keycloakify, the open source toolkit for building Keycloak login, account and email themes with React. Its official shadcn/ui + Tailwind starter is a ready-made place to begin.