Email based OTP for MFA

Navin Kaushik

unread,

Jul 6, 2026, 5:16:35 AMJul 6

to Keycloak User

Hello All,

Email based OTP is not there as part of core, any recommended extension for the same?

-Thanks,

Navin

Navin Kaushik

unread,

Jul 6, 2026, 5:19:55 AMJul 6

to Keycloak User

Thinking of using this one: https://github.com/for-keycloak/email-otp-authenticator

But I would like to take views from the community.

-Regards,

Navin

Garth

unread,

Jul 6, 2026, 5:21:15 AMJul 6

to Navin Kaushik, 'Thomas Darimont' via Keycloak User

This extension bundle contains an implementation: https://github.com/p2-inc/keycloak-magic-link

> --
> You received this message because you are subscribed to the Google
> Groups "Keycloak User" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to keycloak-use...@googlegroups.com.
> To view this discussion visit
> https://groups.google.com/d/msgid/keycloak-user/f7a12c3b-0619-4213-8eb7-d2faba90f055n%40googlegroups.com
> <https://groups.google.com/d/msgid/keycloak-user/f7a12c3b-0619-4213-8eb7-d2faba90f055n%40googlegroups.com?utm_medium=email&utm_source=footer>.

David Cook

unread,

Jul 6, 2026, 8:22:28 PMJul 6

to Garth, Navin Kaushik, 'Thomas Darimont' via Keycloak User

It is a shame that it's not part of core.

I haven't tried it but https://github.com/p2-inc/keycloak-magic-link is listed on https://www.keycloak.org/extensions . That said, the warning at the top of that page says that the extensions are not vetted by the Keycloak team, so that doesn't necessarily mean anything for its trustworthiness. You'd want to double-check the source code.

David Cook
Lead Software Engineer
Prosentient Systems
Suite 7.03
6a Glen St
Milsons Point NSW 2061
Australia

Office: 02 9212 0899

To view this discussion visit https://groups.google.com/d/msgid/keycloak-user/9593c428-b154-4595-b8be-ddaddca7b3fe%40app.fastmail.com.

Aurunisbi Aldino Aulia

unread,

Jul 6, 2026, 9:47:28 PMJul 6

to Keycloak User

Hi,

I've just add Email OTP from https://github.com/for-keycloak/email-otp-authenticator, simple just copy to directory where keycloak installed in your env, then setting up things in the keycloak dashboard (Realm-Authentication-Required Actions, Flows, Add Email Auth to each user, modify the page using keycloakify).
Seems working fine.

Navin Kaushik

unread,

Jul 14, 2026, 3:46:24 AMJul 14

to Keycloak User

Hello All,

Thanks everyone for the responses, I finally decided to build our own due to following requirements:

Tenant-level MFA policy / Realm level (ENABLED / DISABLED) managed via Our Portal i.e. calls Keycloak REST API to update realm level configuration
Per-user MFA opt-in (mfa.enabled user attribute)
SSO users (federated identity) exempt from MFA
Configurable OTP parameters per realm
Full i18n support per tenant-branded theme
Future extensibility for SMS / WhatsApp via MFAChannelProvider interface
Compatible with Keycloak v25.0.6.

Though I liked for-keycloak/email-otp-authenticator.

Criteria Finding Verdict

Device trust✅ Trusted IP + device cookie mechanism✅

Realm Level policy modelNo — configuration via Keycloak Admin Console only, not external realm attributes❌ Blocking

i18n✅ Multi-language support✅

KC 25 compatibilityTested against KC 26.x only. KC 25.0.6 (our version) not listed.❌ Untested

LicenseUnlicense — most permissive, no legal blocker✅

MaintenanceActive — last release May 2026 (v1.4.2), 20 releases total✅

MFAChannelProvider extensibilityTightly coupled to email — no interface for SMS/WhatsApp❌

OTP generation securityNot confirmed — no public security audit or code review for CSPRNG usage⚠️

Resend capability✅ Supported✅

SSO exemption via federated identityNo — no getFederatedIdentities() detection❌ Blocking

Stars / community vetting22 stars, 9 forks — very low adoption, minimal community security review❌