Core Conectps
Realm

Core concepts - Realm

What is a Realm?

A realm is a self-contained authentication environment. It groups the users, clients, and availabilities that belong together, and it draws the hard boundary nothing crosses: users authenticate against their realm, tokens are valid within their realm, and realms have no knowledge of each other. One user, one login pair, one realm — and every application registered there trusts it.

The analogy version: a realm is what Keycloak calls a realm (and what a tenancy boundary is in multi-tenant systems) — your org’s own private identity universe, distinct from every other universe hosted on the same platform.

A realm typically maps to one organization or one product family. The apartment-building intuition — clients are separate apartments that don’t share keys, but residents of the realm share one entrance. Distinct apps that should share users? Same realm. Different companies, or staging vs. production? Different realms.

flowchart TD subgraph RealmA["Realm B"] UA[User<br/>one login pair] CA1[Client 1] --> AA1[Availability 1] CA2[Client 2] --> AA1 UA -->|one session, recognized by all| CA1 UA --> CA2 end subgraph RealmB["Realm A"] UB[User<br/>one login pair] CB1[Client 1] --> AB1[Availability 1] UB -->|one session| CB1 end classDef user fill:#6d4aff,stroke:#553bd8,color:#ffffff classDef client fill:#c7a5ff,stroke:#9b61ff,color:#2e1a47 classDef avail fill:#9b61ff,stroke:#7a4fd8,color:#ffffff class UA,UB user class CA1,CA2,CB1 client class AA1,AB1 avail