CaptchaLaCaptchaLa
Keycloak Integration

Add CAPTCHA to your Keycloak flows

Protects Keycloak browser login, self-registration and reset-password screens with a server-side-verified challenge. One provider JAR, no code.

View on GitHub Try the demo
Keycloak 26+ · Java 17 Server-issued, single-use tokens Open source, single JAR
/admin/master/console/#/realm/authentication
Captchala Username Password Form
cl_pub_a8f3…29c1
••••••••••••••••
RequirementREQUIRED

Why CaptchaLa on Keycloak

Server-side verification on the screens bots target first.

Privacy-first

No third-party tracking pixels, no advertising signals. Your users aren't profiled. Compliant with GDPR, CCPA and PIPL out of the box.

Server-side anti-replay

Keycloak mints a one-time token at render and validates it server-side with your App Secret. A solved token can't be reused or shared across forms.

Drop-in, no code

A single provider JAR into providers/, run kc.sh build, add the executions to your flows and paste two keys. The secret never reaches the browser.

Where it protects

Add each flow independently in the authentication settings.

Browser login
Self-registration
Reset password

Install in 3 steps

Deploy the provider, then wire your flows.

  1. 1

    Deploy the JAR

    Copy keycloak-captchala.jar into /opt/keycloak/providers/, run kc.sh build and restart. Set the login theme to 'captchala'.

  2. 2

    Paste your keys

    Sign up at captcha.la, copy your App Key and App Secret, and paste them into the Captchala execution's config (the gear icon).

  3. 3

    Pick the flows to protect

    Add the Captchala step to the browser, registration and/or reset-credentials flows — login, registration, password reset, done.

Frequently asked questions

Is the Keycloak plugin free?

Yes — the plugin is free and open source. CaptchaLa's free plan includes 10,000 verifications per month; you only pay if you need more volume.

Which Keycloak versions are supported?

Keycloak 26+ on the Quarkus distribution, built against 26.5.6 with Java 17. Drop the JAR into providers/, run kc.sh build, and restart.

Which screens can it protect?

Browser login, self-registration and reset password. Each flow is added independently, so you can protect one, two or all three.

Is the App Secret ever exposed to the browser?

No. The secret is stored masked and only ever sent in the X-App-Secret header from Keycloak to the CaptchaLa API. It never appears in any page, template or log.

What happens if the CaptchaLa API is unreachable?

By default the plugin fails closed and the submission is denied. You can switch any execution to fail open for staged rollout.

Secure your Keycloak realm

Start free — 10,000 verifications a month, no credit card.

Get started free