# Keycloak experimental AuthZEN Support

DevFeed: [Keycloak experimental AuthZEN Support](<https://devfeed.tech/articles/keycloak-experimental-authzen-support-31771.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2026/05/authzen-as-experimental-feature>)

Author: Ryan Emerson

Published: 2026-05-20T00:00:00Z

Content type: release

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [openid](<https://devfeed.tech/topics/openid.md>), [API](<https://devfeed.tech/topics/api.md>), [REST API](<https://devfeed.tech/topics/rest-api.md>), [interoperability](<https://devfeed.tech/topics/interoperability.md>), [vendor lock-in](<https://devfeed.tech/topics/vendor-lock-in.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [changes](<https://devfeed.tech/tags/changes.md>), [idm](<https://devfeed.tech/tags/idm.md>), [interoperability](<https://devfeed.tech/tags/interoperability.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [release](<https://devfeed.tech/tags/release.md>), [resource](<https://devfeed.tech/tags/resource.md>), [rest-api](<https://devfeed.tech/tags/rest-api.md>), [saml](<https://devfeed.tech/tags/saml.md>), [sdks](<https://devfeed.tech/tags/sdks.md>), [sso](<https://devfeed.tech/tags/sso.md>), [vendor-lock-in](<https://devfeed.tech/tags/vendor-lock-in.md>), [works](<https://devfeed.tech/tags/works.md>)

## AI overview

Keycloak announces experimental support for the OpenID AuthZEN Authorization API 1.0 specification starting with version 26.7.0. The feature lets Keycloak act as a Policy Decision Point and expose existing authorization policies through a standardized API for Policy Enforcement Points.

## Source excerpt

We are excited to announce that from 26.7.0, Keycloak will include experimental support for the OpenID AuthZEN Authorization API 1.0 specification. This allows Keycloak to act as a Policy Decision Point (PDP), exposing its authorization capabilities through a standardized API that any Policy Enforcement Point (PEP) can consume. You can try this now with the Keycloak nightly release. Why AuthZEN? Authorization has long been fragmented, with competing systems defining their own protocols for answering the same fundamental question: "Can this subject perform this action on this resource?". This means applications are tightly coupled to whichever authorization backend they choose, and swapping providers requires rewriting integration code. AuthZEN changes this by defining a single, vendor-neutral API between the component that asks (the PEP) and the component that decides (the PDP). It is, in many ways, what OpenID Connect did for authentication -- but for authorization. With AuthZEN: No more vendor lock-in -- your application speaks one API regardless of the PDP behind it. RBAC, ABAC, and ReBAC under one roof -- different policy models can answer the same request format, enabling true interoperability across authorization paradigms. Centralized, externalized authorization -- policy logic lives in the PDP, not scattered across application code, making it easier to audit and update. Simpler integration -- a clean REST API with a minimal request/response model replaces complex, implementation-specific SDKs. A growing ecosystem OpenID AuthZEN Interop demonstrates that over a dozen independently-developed PDPs can be used interchangeably by the same PEP without changing a single line of application code. By adding AuthZEN support, Keycloak joins this ecosystem and lets you leverage your existing Keycloak policies through the same standardized API used by every other AuthZEN-compatible PDP. How it works The interaction between your application and Keycloak follows the standard PE