Keycloak integration
Refuse disposable emails and repeat signups in Keycloak
SignupBouncer for Keycloak is a step for the registration form of Keycloak 26. It checks each new signup's email address and IP address before Keycloak creates the account. It's open source under the MIT license.
- Get a free key. You create an API key on your app's Integration tab.
- Copy the SignupBouncer JAR file into Keycloak, and add the SignupBouncer step to your registration flow.
- Register with a test address, and find the signup on the Checks tab. Watch your signups in shadow mode, then switch the app to enforce.
What SignupBouncer refuses
The SignupBouncer step sends us the email address and IP address from each registration form. In enforce mode, we refuse a signup marked block, and Keycloak creates no account. On every plan, the email checks look for:
- a disposable email domain, or a new domain whose mail goes to a known burner mail server
- a domain that can't receive email
- the same inbox signing up again under another spelling, such as Gmail dots or a
+tag. Each repeat within 7 days adds points.
On the Starter plan and up, the signup's IP adds points when it comes from a datacenter, a VPN, Tor or a hijacked network. On the Free plan, we run the IP checks too, and your log lists what they found.
Full setup in the docs
For the full setup, read the Keycloak extension page in our docs, which lists the install steps and the steps to turn the extension off.
More
- Keycloak in our docs, next to the REST API and the reason codes.
- The extension's source code on GitHub.
- Keycloak's outgoing HTTP guide.
Start on the Free plan
1 app and 1,000 checks a month. No card. Shadow mode logs what we would refuse until you switch the app to enforce.