---
title: Keycloak OAuth SMTP Configuration
description: "- [Overview](https://reframe-data.atlassian.net/wiki/spaces/DEVOPS/pages/222527489/Keycloak+OAuth+SMTP+Configuration#%3Ainfo%3A-Overview) - [✅ Prerequisites](https://reframe-data.atlassian.net/wiki/spaces/DEVOPS/pages/222527489/Keycloak+OAuth+SMTP+Configuration#%E2%9C%85-Prerequisites) - [🔧 Step-by-Step Configuration](https://reframe-data.atlassian.net/wiki/spaces/DEVOPS/pages/222527489/Keycloak+OAuth+SMTP+Configuration#%F0%9F%94%A7-Step-by-Step-Configuration) - [Create App with OAuth2 in Entra ID](https://reframe-data.atlassian.net/wiki/spaces/DEVOPS/pages/222527489/Keycloak+OAuth+SMTP+Configuration#%F0%9F%93%A7--Create-App-with-OAuth2-in-Entra-ID) - [🧭 Configure SMTP with OAuth2 in Keycloak](https://reframe-data.atlassian.net/wiki/spaces/DEVOPS/pages/222527489/Keycloak+OAuth+SMTP+Configuration#%F0%9F%A7%AD-Configure-SMTP-with-OAuth2-in-Keycloak) ## ![Info](https://pf-emoji-service--cdn.us-east-1.prod.public.atl-paas.net/atlassian/productivityEmojis/information-32px.png) **Overview** Starting from version **Keycloak 26+**, Keycloak supports **OAuth2-based SMTP authentication**. This configuration…"
url: "https://docs.re-frame.cloud/docs/portfolio/keycloak-oauth-smtp-configuration/"
updated: "2025-11-24"
category: Portfolio
---

# Keycloak OAuth SMTP Configuration

- [Overview](https://reframe-data.atlassian.net/wiki/spaces/DEVOPS/pages/222527489/Keycloak+OAuth+SMTP+Configuration#%3Ainfo%3A-Overview)
- [✅ Prerequisites](https://reframe-data.atlassian.net/wiki/spaces/DEVOPS/pages/222527489/Keycloak+OAuth+SMTP+Configuration#%E2%9C%85-Prerequisites)
- [🔧 Step-by-Step Configuration](https://reframe-data.atlassian.net/wiki/spaces/DEVOPS/pages/222527489/Keycloak+OAuth+SMTP+Configuration#%F0%9F%94%A7-Step-by-Step-Configuration)
  - [Create App with OAuth2 in Entra ID](https://reframe-data.atlassian.net/wiki/spaces/DEVOPS/pages/222527489/Keycloak+OAuth+SMTP+Configuration#%F0%9F%93%A7--Create-App-with-OAuth2-in-Entra-ID)
  - [🧭 Configure SMTP with OAuth2 in Keycloak](https://reframe-data.atlassian.net/wiki/spaces/DEVOPS/pages/222527489/Keycloak+OAuth+SMTP+Configuration#%F0%9F%A7%AD-Configure-SMTP-with-OAuth2-in-Keycloak)

## ![Info](https://pf-emoji-service--cdn.us-east-1.prod.public.atl-paas.net/atlassian/productivityEmojis/information-32px.png) **Overview**

Starting from version **Keycloak 26+**, Keycloak supports **OAuth2-based SMTP authentication**. This configuration is essential when using mail providers that have deprecated **basic authentication** (e.g., Microsoft Entra ID / Gmail).

This document provides step-by-step instructions to configure Keycloak 26 for sending emails over **SMTP using OAuth 2.0 in Office365.**

## **✅ Prerequisites**

Before starting, ensure you have:

- A Keycloak 26+ instance deployed ).
- A valid **OAuth2 client application** configured on your email provider:
  - For Microsoft: Entra ID → App Registrations.

## **🔧 Step-by-Step Configuration**

### ![e-mail](https://pf-emoji-service--cdn.us-east-1.prod.public.atl-paas.net/standard/ef8b0642-7523-4e13-9fd3-01b65648acf6/32x32/1f4e7.png) **Create App with OAuth2 in Entra ID**

1. Sign in to the [Microsoft Entra ID](https://entra.microsoft.com/).
2. Click **App registrations** on the left menu.
3. Click **New registration**.
4. Register the Application with the following data:
   1. **Name**: Keycloak SMTP OAuth.
   2. **Supported account types**: My organization only.
   3. Click **Register** to finish.
5. Create**a Client Secret**
   1. In the newly created app, go to **Certificates & secrets**.
   2. Under **Client secrets**, click **+ New client secret**.
   3. Add a description like SMTP OAuth for Keycloak, choose expiry duration, and click **Add**.
   4. **Copy the client secret value immediately** (it won’t be shown again).
6. Assign**API Permissions**
   1. Go to **API Permissions** → Click **+ Add a permission**.
   2. Choose **APIs my organization uses**.
   3. Search for and select `Office 365 Exchange Online`.
   4. Click **Application permissions**.
   5. Expand the section and select the following:
      1. `IMAP.AccessAsApp`
      2. `Mail.Read`
      3. `Mail.ReadWrite`
      4. `Mail.Send`
      5. `Mailbox.Settings.ReadWrite`
      6. `POP.AccessAsApp`
      7. `SMTP.SendAsApp`
   6. Click **Add Permissions.**
   7. Back on the permissions page, click **Grant admin consent**.

🔒**Store the client secret securely** (e.g., Vault, Kubernetes Secret).

### **🧭 Configure SMTP with OAuth2 in Keycloak**

1. Log in to the **Keycloak Admin Console**.
2. Navigate to **Realm Settings** from the left-hand menu.
3. Click the **Email** tab.
4. Fill in the following fields in the **Email** settings page:

| **Field** | **Value** |
| --- | --- |
| Host | `smtp.office365.com` |
| Port | `587` |
| Encryption | `StartTLS` |
| Authentication | `token` |
| Username | `support@reframe-data.io` |
| Auth Token URL | [https://login.microsoftonline.com/](https://login.microsoftonline.com/)<tenant-id>/oauth2/v2.0/token |
| Auth Token Scope | [https://outlook.office365.com/.default](https://outlook.office365.com/.default) |
| Auth Token ClientId | <application-client-id> |
| Auth Token Client Secret | <application-client-secret-value> |

1. Save the **Email Settings.**
2. Click the **Test Connection** button and verify that test email is send.