Work16 May 2026·1 minTable of ContentsKeycloak extensionsBot and brute-force protectionPer-client webhooksDisposable email blockingTable of ContentsKeycloak extensionsBot and brute-force protectionPer-client webhooksDisposable email blockingProjects I’ve built or contributed to. Mostly scratching my own itches — tools I needed that didn’t exist, or existing ones I wanted to improve.Keycloak extensions#Standard Keycloak SPIs — drop the JAR in, configure, done.Bot and brute-force protection#Mr Buch / Keycloak / Keycloak PoWAdds proof-of-work challenges to Keycloak login, registration, and password-reset flows. Uses Argon2 or SHA-256 with IP-adaptive difficulty. Three-layer defense: honeypot detection, solve-time validation, and nonce replay prevention.00Read the writeup →Per-client webhooks#Mr Buch / Keycloak / Keycloak Client WebhookPOSTs Keycloak user events to your backend on a per-client basis — no polling, no database queries. Supports registration, login, logout, password reset, and more. Runs async so Keycloak never blocks on your endpoint.00Read the writeup →Disposable email blocking#Mr Buch / Keycloak / Keycloak Block Disposable EmailBlocks disposable and throwaway email addresses at Keycloak registration. Checks against a maintained provider list and rejects before the account is created.00