# Keycloak 26.6.0 released

DevFeed: [Keycloak 26.6.0 released](<https://devfeed.tech/articles/keycloak-26-6-0-released-31765.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2026/04/keycloak-2660-released>)

Author: Keycloak Team

Published: 2026-04-08T00:00:00Z

Content type: release

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [releases](<https://devfeed.tech/topics/releases.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [Security](<https://devfeed.tech/topics/security.md>), [openid](<https://devfeed.tech/topics/openid.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [SPIFFE](<https://devfeed.tech/topics/spiffe.md>)

Tags: [idm](<https://devfeed.tech/tags/idm.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [keycloak-release](<https://devfeed.tech/tags/keycloak-release.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [oauth-2-0](<https://devfeed.tech/tags/oauth-2-0.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [release](<https://devfeed.tech/tags/release.md>), [releases](<https://devfeed.tech/tags/releases.md>), [saml](<https://devfeed.tech/tags/saml.md>), [security](<https://devfeed.tech/tags/security.md>), [sso](<https://devfeed.tech/tags/sso.md>), [test](<https://devfeed.tech/tags/test.md>)

## AI overview

Keycloak 26.6.0 introduces JWT Authorization Grant, federated client authentication, workflows for realm administration, zero-downtime patch releases, and a new test framework. The release also includes a preview of Identity Brokering APIs V2 and a guide to OAuth 2.0 DPoP.

## Source excerpt

To download the release go to Keycloak downloads. Highlights This release features new capabilities for users and administrators of Keycloak. The highlights of this release are: JWT Authorization Grant, enabling external-to-internal token exchange using externally signed JWT assertions. Federated client authentication, eliminating the need to manage individual client secrets in Keycloak. Workflows, enabling administrators to automate realm administrative tasks such as user and client lifecycle management. Zero-downtime patch releases, allowing rolling updates within a minor release stream without service downtime. The Keycloak Test Framework, replacing the previous Arquillian-based solution. All of these features are now fully supported and no longer in preview. Read on to learn more about each new feature. If you are upgrading from a previous release, also review the changes listed in the upgrading guide. Security and Standards JWT Authorization Grant (supported) JWT Authorization Grant (RFC 7523) is designed to implement external-to-internal token exchange use cases. This grant allows using externally signed JWT assertions to request OAuth 2.0 access tokens. In this release, JWT Authorization Grant is promoted from preview to supported. See the JWT Authorization Grant guide for additional details. Federated client authentication (supported) Federated client authentication allows clients to leverage existing credentials once a trust relationship with another issuer exists. It eliminates the need to assign and manage individual secrets for each client in Keycloak. Federated client authentication is now promoted to supported, including support for client assertions issued by external OpenID Connect identity providers and Kubernetes Service Accounts. Since the OAuth SPIFFE Client Authentication specification is still in draft status, this feature remains a preview feature in Keycloak. New guide about Demonstrating Proof-of-Possession (DPoP) A new guide for OAuth 2.0 D