Keycloak starter kits · one per stack

Stop reverse-engineering
Keycloak blog posts.

docker compose up to a working login. PKCE, silent SSO, JWKS verification, the 401 refresh queue — written, tested, and documented. One kit per stack; every kit ships the same realm.

Get a kit — from $29 Pick your stack ↓
$ docker compose up --build
keycloak   realm auto-imported (clients, roles, demo users)
your app   wired, guarded, and logged in
→ demo-admin / demo1234. That's the setup.
$ tree realmkit-angular -L 2
realmkit-angular/
├── docker-compose.yml # Keycloak + app, one command
├── realm/
│   └── keycloak-template.json # the shared realm — same export in every kit
├── src/app/auth/ # init, interceptor, guards
├── scripts/e2e-smoke.sh # scripted PKCE login
├── docs/ # architecture, flows, troubleshooting
└── .github/workflows/ci.yml

Pick your stack

Aa

RealmKit for Angular

The Keycloak SPA kit — Angular 22 · keycloak-angular 22 · keycloak-js 26

check-sso + PKCE S256 bootstrap, silent SSO — no redirect loops
The 401 refresh queue: N concurrent 401s, one refresh
Role guards as route data + full lazy-loaded shell
Scripted PKCE login e2e + CI on every push
{}

RealmKit for Node.js

The Keycloak API kit — Express · JWKS · issuer + audience validation

JWKS verification — survives key rotation, zero pasted keys
Issuer and audience validation on by default
hasRole / hasAnyRole / hasScope middleware family
Swagger on every endpoint, unit + e2e tests, CI

One realm, every kit

Tokens issued to the UI validate at the API — by construction, not configuration.

keycloak-template-ui
RealmKit for Angular
public client · PKCE S256
audience mapper → the API
realm: keycloak-template
clients · roles · demo users
one export, in every kit
keycloak-template-nodejs
RealmKit for Node.js
confidential audience · JWKS
issuer + aud validation

Buy one layer today, add the other later — same realm, zero re-wiring.

Pricing

RealmKit for Angular
$29 one-time
✓ Full source: compose, realm, SPA auth surface
✓ Unlimited projects, commercial included
✓ Tests, CI workflow, full documentation
✓ v1.x updates included
Coming soon
RealmKit for Node.js
$29 one-time
✓ Full source: compose, realm, hardened API surface
✓ Unlimited projects, commercial included
✓ Tests, CI workflow, full documentation
✓ v1.x updates included
Coming soon

Launch pricing — one-time purchase, no subscription. Unlimited projects on every kit.
Paid kits open soon — start with the free tiers on GitHub.

FAQ

Do the kits work together?

Yes — by construction. Every RealmKit ships the same realm export (same clients, roles, and audience mapper), so the Angular kit's tokens are exactly what the Node kit's API validates. Run either alone, or both against one Keycloak.

Does it work with my existing Keycloak?

Yes — the bundled compose stack is the zero-setup path, but every kit's realm guide also covers importing the realm into your own instance and pointing the kit at it.

What's in the free tiers?

Each stack has an MIT-licensed minimal starter on GitHub — the correct bootstrap and one guarded route, pointed at your own Keycloak. The paid kits add the Docker bootstrap with the pre-wired realm, the full production surface (refresh queue, silent SSO, the complete middleware family), tests, CI, and docs.

How do I receive it?

Instant zip download after checkout. Updates ship the same way — re-download the latest zip anytime from your purchase library (sign in with the email you bought with).

What license?

Plain-language commercial license: unlimited use in your own and client projects; no reselling or republishing the kit itself as a template. Free tiers are MIT.

Read more first?

Keycloak + Angular + Node in 2026: the five places everyone gets it wrong — the launch article walks through the exact problems these kits solve.