# Experimental Shared Signals Framework support

DevFeed: [Experimental Shared Signals Framework support](<https://devfeed.tech/articles/experimental-shared-signals-framework-support-31782.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2026/07/experimental-ssf-support>)

Author: Thomas Darimont

Published: 2026-07-03T00:00:00Z

Content type: release

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [openid](<https://devfeed.tech/topics/openid.md>), [Security](<https://devfeed.tech/topics/security.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [Software as a service](<https://devfeed.tech/topics/saas.md>)

Tags: [experimental](<https://devfeed.tech/tags/experimental.md>), [http](<https://devfeed.tech/tags/http.md>), [idm](<https://devfeed.tech/tags/idm.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [openid](<https://devfeed.tech/tags/openid.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [release](<https://devfeed.tech/tags/release.md>), [saas](<https://devfeed.tech/tags/saas.md>), [saml](<https://devfeed.tech/tags/saml.md>), [security](<https://devfeed.tech/tags/security.md>), [sso](<https://devfeed.tech/tags/sso.md>)

## AI overview

Keycloak announces experimental support for the OpenID Shared Signals Framework 1.0 in its nightly release. It can transmit signed Security Event Tokens about identity-related events to subscribed receivers over standardized HTTP push or poll channels, enabling faster propagation of changes such as session revocation, account disabling, credential rotation, and device non-compliance.

## Source excerpt

We are excited to announce that Keycloak now provides experimental support for the OpenID Shared Signals Framework 1.0 specification, available from today in the nightly release. This allows Keycloak to act as a Shared Signals Transmitter, pushing signed Security Event Tokens (SETs) about identity-relevant events to any subscribed Receiver, using a standardised wire format defined by the OpenID Foundation. This closes a long-standing gap. When you revoke a user's session in Keycloak today, the SaaS app they're logged into usually doesn't sign them out until their next token refresh, which can be minutes, hours, or in some cases never. The same gap exists when an account is disabled, a credential is rotated, or a device is flagged as non-compliant. Keycloak knows; the relying parties don't, until they happen to ask again. With SSF, Keycloak can now push those signals to subscribed receivers in seconds -- no per-vendor webhooks, no bespoke polling endpoints, no Kafka topic per integration. Concretely, this also unlocks an integration the Keycloak ecosystem has been missing: Keycloak can now act as the federated IdP for Apple Business and Apple School Manager, signalling user-state changes back to Apple so enrolled devices can ask the user to reauthenticate. This post is the first in a small series. It introduces SSF, walks through what's actually shipped in the experimental release, and outlines where we'd like to take it next. Follow-up posts will cover how to define custom events, how to emit synthetic events, and an Apple Business and Apple School Manager integration end to end. A short tour of Shared Signals The OpenID Foundation's Shared Signals Framework 1.0 defines a standard way for one party (the Transmitter) to tell another party (the Receiver) about identity-relevant events as they happen. Each event is delivered as a signed JWT, a Security Event Token (RFC 8417) delivered over either an HTTP push channel (RFC 8935) or an HTTP poll channel (RFC 8936). Two pr