Start the server.

Usage:

kc.sh start [OPTIONS]

Use this command to run the server in production.

Options:

-h, --help           This help message.
--help-all           This same help message but with additional options.
--import-realm       Import realms during startup by reading any realm configuration file from the
                       'data/import' directory.
--optimized          Use this option to achieve an optimal startup time if you have previously
                       built a server image using the 'build' command.
-v, --verbose        Print out error details when running this command.

Cache:

--cache <type>       Defines the cache mechanism for high-availability. By default in production
                       mode, a 'ispn' cache is used to create a cluster between multiple server
                       nodes. By default in development mode, a 'local' cache disables clustering
                       and is intended for development and testing purposes. Possible values are:
                       ispn, local. Default: ispn.
--cache-config-file <file>
                     Defines the file from which cache configuration should be loaded from. The
                       configuration file is relative to the 'conf/' directory.
--cache-config-mutate <true|false>
                     Determines whether changes to the default cache configurations are allowed.
                       This is only recommended for advanced use-cases where the default cache
                       configurations are proven to be problematic. The only supported way to
                       change the default cache configurations is via the other 'cache-...'
                       options. Default: false.
--cache-embedded-authorization-max-count <max-count>
                     The maximum number of entries that can be stored in-memory by the
                       authorization cache.
--cache-embedded-client-sessions-max-count <max-count>
                     The maximum number of entries that can be stored in-memory by the
                       clientSessions cache. Available only when embedded Infinispan clusters
                       configured.
--cache-embedded-crl-max-count <max-count>
                     The maximum number of entries that can be stored in-memory by the crl cache.
--cache-embedded-keys-max-count <max-count>
                     The maximum number of entries that can be stored in-memory by the keys cache.
--cache-embedded-mtls-enabled <true|false>
                     Encrypts the network communication between Keycloak servers. If no additional
                       parameters about a keystore and truststore are provided, ephemeral key pairs
                       and certificates are created and rotated automatically, which is recommended
                       for standard setups. Default: true. Available only when a TCP based
                       cache-stack is used.
--cache-embedded-mtls-key-store-file <file>
                     The Keystore file path. The Keystore must contain the certificate to use by
                       the TLS protocol. By default, it looks up 'cache-mtls-keystore.p12' under
                       conf/ directory. Available only when property 'cache-embedded-mtls-enabled'
                       is enabled.
--cache-embedded-mtls-key-store-password <password>
                     The password to access the Keystore. Available only when property
                       'cache-embedded-mtls-enabled' is enabled.
--cache-embedded-mtls-rotation-interval-days <days>
                     Rotation period in days of automatic JGroups MTLS certificates. Default: 30.
                       Available only when property 'cache-embedded-mtls-enabled' is enabled.
--cache-embedded-mtls-trust-store-file <file>
                     The Truststore file path. It should contain the trusted certificates or the
                       Certificate Authority that signed the certificates. By default, it lookup
                       'cache-mtls-truststore.p12' under conf/ directory. Available only when
                       property 'cache-embedded-mtls-enabled' is enabled.
--cache-embedded-mtls-trust-store-password <password>
                     The password to access the Truststore. Available only when property
                       'cache-embedded-mtls-enabled' is enabled.
--cache-embedded-network-bind-address <address>
                     IP address used by clustering transport. By default, SITE_LOCAL is used.
                       Available only when Infinispan clustered embedded is enabled.
--cache-embedded-network-bind-port <port>
                     The Port the clustering transport will bind to. By default, port 7800 is used.
                       Available only when Infinispan clustered embedded is enabled.
--cache-embedded-network-external-address <address>
                     IP address that other instances in the cluster should use to contact this
                       node. Set only if it is different to cache-embedded-network-bind-address,
                       for example when this instance is behind a firewall. Available only when
                       Infinispan clustered embedded is enabled.
--cache-embedded-network-external-port <port>
                     Port that other instances in the cluster should use to contact this node. Set
                       only if it is different to cache-embedded-network-bind-port, for example
                       when this instance is behind a firewall Available only when Infinispan
                       clustered embedded is enabled.
--cache-embedded-offline-client-sessions-max-count <max-count>
                     The maximum number of entries that can be stored in-memory by the
                       offlineClientSessions cache. Available only when embedded Infinispan
                       clusters configured.
--cache-embedded-offline-sessions-max-count <max-count>
                     The maximum number of entries that can be stored in-memory by the
                       offlineSessions cache. Available only when embedded Infinispan clusters
                       configured.
--cache-embedded-realms-max-count <max-count>
                     The maximum number of entries that can be stored in-memory by the realms cache.
--cache-embedded-sessions-max-count <max-count>
                     The maximum number of entries that can be stored in-memory by the sessions
                       cache. Available only when embedded Infinispan clusters configured.
--cache-embedded-users-max-count <max-count>
                     The maximum number of entries that can be stored in-memory by the users cache.
--cache-metrics-histograms-enabled <true|false>
                     Enable histograms for metrics for the embedded caches. Default: false.
                       Available only when metrics are enabled.
--cache-remote-backup-sites <sites>
                     Configures a list of backup sites names to where the external Infinispan
                       cluster backups the Keycloak data. Available only when remote host is set.
--cache-remote-host <hostname>
                     The hostname of the external Infinispan cluster. Available only when feature
                       'multi-site' or 'clusterless' is set. Required when feature 'multi-site' or
                       'clusterless' is set.
--cache-remote-password <password>
                     The password for the authentication to the external Infinispan cluster. It is
                       optional if connecting to an unsecure external Infinispan cluster. If the
                       option is specified, 'cache-remote-username' is required as well. Available
                       only when remote host is set.
--cache-remote-port <port>
                     The port of the external Infinispan cluster. Default: 11222. Available only
                       when remote host is set.
--cache-remote-tls-enabled <true|false>
                     Enable TLS support to communicate with a secured remote Infinispan server.
                       Recommended to be enabled in production. Default: true. Available only when
                       remote host is set.
--cache-remote-username <username>
                     The username for the authentication to the external Infinispan cluster. It is
                       optional if connecting to an unsecure external Infinispan cluster. If the
                       option is specified, 'cache-remote-password' is required as well. Available
                       only when remote host is set.
--cache-stack <stack>
                     Define the default stack to use for cluster communication and node discovery.
                       Defaults to 'jdbc-ping' if not set. Possible values are: jdbc-ping,
                       kubernetes (deprecated), jdbc-ping-udp (deprecated), tcp (deprecated), udp
                       (deprecated), ec2 (deprecated), azure (deprecated), google (deprecated), or
                       a custom one. Available only when 'cache' type is set to 'ispn'.

Config:

--config-keystore <config-keystore>
                     Specifies a path to the KeyStore Configuration Source.
--config-keystore-password <config-keystore-password>
                     Specifies a password to the KeyStore Configuration Source.
--config-keystore-type <config-keystore-type>
                     Specifies a type of the KeyStore Configuration Source. Default: PKCS12.

Database:

--db-debug-jpql <true|false>
                     Add JPQL information as comments to SQL statements to debug JPA SQL statement
                       generation. Default: false.
--db-log-slow-queries-threshold <milliseconds>
                     Log SQL statements slower than the configured threshold with logger org.
                       hibernate.SQL_SLOW and log-level info. Default: 10000.
--db-password <password>
                     The password of the database user.
--db-pool-initial-size <size>
                     The initial size of the connection pool.
--db-pool-max-lifetime <duration>
                     The maximum time a connection remains in the pool, after which it will be
                       closed upon return and replaced as necessary. May be an ISO 8601 duration
                       value, an integer number of seconds, or an integer followed by one of [ms,
                       h, m, s, d].
--db-pool-max-size <size>
                     The maximum size of the connection pool. Default: 100.
--db-pool-min-size <size>
                     The minimal size of the connection pool.
--db-schema <schema> The database schema to be used.
--db-url <jdbc-url>  The full database JDBC URL. If not provided, a default URL is set based on the
                       selected database vendor. For instance, if using 'postgres', the default
                       JDBC URL would be 'jdbc:postgresql://localhost/keycloak'.
--db-url-database <dbname>
                     Sets the database name of the default JDBC URL of the chosen vendor. If the
                       `db-url` option is set, this option is ignored.
--db-url-host <hostname>
                     Sets the hostname of the default JDBC URL of the chosen vendor. If the
                       `db-url` option is set, this option is ignored.
--db-url-port <port> Sets the port of the default JDBC URL of the chosen vendor. If the `db-url`
                       option is set, this option is ignored.
--db-url-properties <properties>
                     Sets the properties of the default JDBC URL of the chosen vendor. Make sure to
                       set the properties accordingly to the format expected by the database
                       vendor, as well as appending the right character at the beginning of this
                       property value. If the `db-url` option is set, this option is ignored.
--db-username <username>
                     The username of the database user.

Database - additional datasources:

--db-debug-jpql-<datasource> <true|false>
                     Used for named <datasource>. Add JPQL information as comments to SQL
                       statements to debug JPA SQL statement generation. Default: false.
--db-enabled-<datasource> <true|false>
                     If the named datasource <datasource> should be enabled at runtime. Default:
                       true.
--db-log-slow-queries-threshold-<datasource> <milliseconds>
                     Used for named <datasource>. Log SQL statements slower than the configured
                       threshold with logger org.hibernate.SQL_SLOW and log-level info. Default:
                       10000.
--db-password-<datasource> <password>
                     Used for named <datasource>. The password of the database user.
--db-pool-initial-size-<datasource> <size>
                     Used for named <datasource>. The initial size of the connection pool.
--db-pool-max-size-<datasource> <size>
                     Used for named <datasource>. The maximum size of the connection pool. Default:
                       100.
--db-pool-min-size-<datasource> <size>
                     Used for named <datasource>. The minimal size of the connection pool.
--db-schema-<datasource> <schema>
                     Used for named <datasource>. The database schema to be used.
--db-url-database-<datasource> <dbname>
                     Used for named <datasource>. Sets the database name of the default JDBC URL of
                       the chosen vendor. If the `db-url` option is set, this option is ignored.
--db-url-full-<datasource> <jdbc-url>
                     Used for named <datasource>. The full database JDBC URL. If not provided, a
                       default URL is set based on the selected database vendor. For instance, if
                       using 'postgres', the default JDBC URL would be 'jdbc:postgresql:
                       //localhost/keycloak'.
--db-url-host-<datasource> <hostname>
                     Used for named <datasource>. Sets the hostname of the default JDBC URL of the
                       chosen vendor. If the `db-url` option is set, this option is ignored.
--db-url-port-<datasource> <port>
                     Used for named <datasource>. Sets the port of the default JDBC URL of the
                       chosen vendor. If the `db-url` option is set, this option is ignored.
--db-url-properties-<datasource> <properties>
                     Used for named <datasource>. Sets the properties of the default JDBC URL of
                       the chosen vendor. Make sure to set the properties accordingly to the format
                       expected by the database vendor, as well as appending the right character at
                       the beginning of this property value. If the `db-url` option is set, this
                       option is ignored.
--db-username-<datasource> <username>
                     Used for named <datasource>. The username of the database user.

Hostname v2:

--hostname <hostname|URL>
                     Address at which is the server exposed. Can be a full URL, or just a hostname.
                       When only hostname is provided, scheme, port and context path are resolved
                       from the request. Available only when hostname:v2 feature is enabled.
--hostname-admin <URL>
                     Address for accessing the administration console. Use this option if you are
                       exposing the administration console using a reverse proxy on a different
                       address than specified in the 'hostname' option. Available only when
                       hostname:v2 feature is enabled.
--hostname-backchannel-dynamic <true|false>
                     Enables dynamic resolving of backchannel URLs, including hostname, scheme,
                       port and context path. Set to true if your application accesses Keycloak via
                       a private network. If set to true, 'hostname' option needs to be specified
                       as a full URL. Default: false. Available only when hostname:v2 feature is
                       enabled.
--hostname-debug <true|false>
                     Toggles the hostname debug page that is accessible at
                       /realms/master/hostname-debug. Default: false. Available only when hostname:
                       v2 feature is enabled.
--hostname-strict <true|false>
                     Disables dynamically resolving the hostname from request headers. Should
                       always be set to true in production, unless your reverse proxy overwrites
                       the Host header. If enabled, the 'hostname' option needs to be specified.
                       Default: true. Available only when hostname:v2 feature is enabled.

HTTP(S):

--http-accept-non-normalized-paths <true|false>
                     DEPRECATED. If the server should accept paths that are not normalized
                       according to RFC3986 or that contain a double slash ('//'). While accepting
                       those requests might be relevant for legacy applications, it is recommended
                       to disable it to allow for more concise URL filtering. Default: false.
--http-enabled <true|false>
                     Enables the HTTP listener. Enabled by default in development mode. Typically
                       not enabled in production unless the server is fronted by a TLS termination
                       proxy. Default: false.
--http-host <host>   The HTTP Host. By default, Keycloak binds to all network addresses (0.0.0.0),
                       which means the server may be accessible from other machines on your
                       network. For local development, you can restrict access to localhost only by
                       setting this to 127.0.0.1. Default: 0.0.0.0.
--http-max-queued-requests <requests>
                     Maximum number of queued HTTP requests. Use this to shed load in an overload
                       situation. Excess requests will return a "503 Server not Available" response.
--http-metrics-histograms-enabled <true|false>
                     Enables a histogram with default buckets for the duration of HTTP server
                       requests. Default: false. Available only when metrics are enabled.
--http-metrics-slos <list of buckets>
                     Service level objectives for HTTP server requests. Use this instead of the
                       default histogram, or use it in combination to add additional buckets.
                       Specify a list of comma-separated values defined in milliseconds. Example
                       with buckets from 5ms to 10s: 5,10,25,50,250,500,1000,2500,5000,10000
                       Available only when metrics are enabled.
--http-pool-max-threads <threads>
                     The maximum number of threads. If this is not specified then it will be
                       automatically sized to the greater of 4 * the number of available processors
                       and 50. For example if there are 4 processors the max threads will be 50. If
                       there are 48 processors it will be 192.
--http-port <port>   The used HTTP port. Default: 8080.
--https-certificate-file <file>
                     The file path to a server certificate or certificate chain in PEM format.
--https-certificate-key-file <file>
                     The file path to a private key in PEM format.
--https-certificates-reload-period <reload period>
                     Interval on which to reload key store, trust store, and certificate files
                       referenced by https-* options. May be an ISO 8601 duration value, an integer
                       number of seconds, or an integer followed by one of [ms, h, m, s, d]. Must
                       be greater than 30 seconds. Use -1 to disable. Default: 1h.
--https-cipher-suites <ciphers>
                     The cipher suites to use. If none is given, a reasonable default is selected.
--https-key-store-file <file>
                     The key store which holds the certificate information instead of specifying
                       separate files.
--https-key-store-password <password>
                     The password of the key store file. Default: password.
--https-key-store-type <type>
                     The type of the key store file. If not given, the type is automatically
                       detected based on the file extension. If 'fips-mode' is set to 'strict' and
                       no value is set, it defaults to 'BCFKS'.
--https-port <port>  The used HTTPS port. Default: 8443.
--https-protocols <protocols>
                     The list of protocols to explicitly enable. If a value is not supported by the
                       JRE / security configuration, it will be silently ignored. Possible values
                       are: TLSv1.3, TLSv1.2, or a custom one. Default: TLSv1.3,TLSv1.2.
--https-trust-store-file <file>
                     The trust store which holds the certificate information of the certificates to
                       trust.
--https-trust-store-password <password>
                     The password of the trust store file.
--https-trust-store-type <type>
                     The type of the trust store file. If not given, the type is automatically
                       detected based on the file extension. If 'fips-mode' is set to 'strict' and
                       no value is set, it defaults to 'BCFKS'.

HTTP Access log:

--http-access-log-enabled <true|false>
                     If HTTP access logging is enabled. By default this will log records in
                       console. Default: false.
--http-access-log-exclude <PARAM>
                     A regular expression that can be used to exclude some paths from logging. For
                       instance, '/realms/my-realm/.*' will exclude all subsequent endpoints for
                       realm 'my-realm' from the log. Available only when HTTP Access log is
                       enabled.
--http-access-log-pattern <PARAM>
                     The HTTP access log pattern. You can use the available named formats, or use
                       custom format described in Quarkus documentation. Possible values are:
                       common, combined, long, or a custom one. Default: common. Available only
                       when HTTP Access log is enabled.

Management:

--http-management-port <port>
                     Port of the management interface. Relevant only when something is exposed on
                       the management interface - see the guide for details. Default: 9000.
--http-management-scheme <scheme>
                     Configures the management interface scheme. If 'inherited', the management
                       interface will inherit the HTTPS settings of the main interface. If 'http',
                       the management interface will be accessible via HTTP - it will not inherit
                       HTTPS settings and cannot be configured for HTTPS. Possible values are:
                       http, inherited. Default: inherited.
--https-management-certificate-file <file>
                     The file path to a server certificate or certificate chain in PEM format for
                       the management server. If not given, the value is inherited from HTTP
                       options. Relevant only when something is exposed on the management interface
                       - see the guide for details. Available only when http-management-scheme is
                       inherited.
--https-management-certificate-key-file <file>
                     The file path to a private key in PEM format for the management server. If not
                       given, the value is inherited from HTTP options. Relevant only when
                       something is exposed on the management interface - see the guide for
                       details. Available only when http-management-scheme is inherited.
--https-management-certificates-reload-period <reload period>
                     Interval on which to reload key store, trust store, and certificate files
                       referenced by https-management-* options for the management server. May be
                       an ISO 8601 duration value, an integer number of seconds, or an integer
                       followed by one of [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1
                       to disable. If not given, the value is inherited from HTTP options. Relevant
                       only when something is exposed on the management interface - see the guide
                       for details. Default: 1h. Available only when http-management-scheme is
                       inherited.
--https-management-key-store-file <file>
                     The key store which holds the certificate information instead of specifying
                       separate files for the management server. If not given, the value is
                       inherited from HTTP options. Relevant only when something is exposed on the
                       management interface - see the guide for details. Available only when
                       http-management-scheme is inherited.
--https-management-key-store-password <password>
                     The password of the key store file for the management server. If not given,
                       the value is inherited from HTTP options. Relevant only when something is
                       exposed on the management interface - see the guide for details. Default:
                       password. Available only when http-management-scheme is inherited.

Proxy:

--proxy-headers <headers>
                     The proxy headers that should be accepted by the server. Misconfiguration
                       might leave the server exposed to security vulnerabilities. Takes precedence
                       over the deprecated proxy option. Possible values are: forwarded, xforwarded.
--proxy-protocol-enabled <true|false>
                     Whether the server should use the HA PROXY protocol when serving requests from
                       behind a proxy. When set to true, the remote address returned will be the
                       one from the actual connecting client. Cannot be enabled when the
                       `proxy-headers` is used. Default: false.
--proxy-trusted-addresses <trusted proxies>
                     A comma separated list of trusted proxy addresses. If set, then proxy headers
                       from other addresses will be ignored. By default all addresses are trusted.
                       A trusted proxy address is specified as an IP address (IPv4 or IPv6) or
                       Classless Inter-Domain Routing (CIDR) notation. Available only when
                       proxy-headers is set.

Vault:

--vault-dir <dir>    If set, secrets can be obtained by reading the content of files within the
                       given directory.
--vault-file <file>  Path to the keystore file.
--vault-pass <pass>  Password for the vault keystore.
--vault-type <type>  Specifies the type of the keystore file. Default: PKCS12.

Logging:

--log <handler>      Enable one or more log handlers in a comma-separated list. Possible values
                       are: console, file, syslog. Default: console.
--log-async <true|false>
                     Indicates whether to log asynchronously to all handlers. Default: false.
--log-console-async <true|false>
                     Indicates whether to log asynchronously to console. If not set, value from the
                       parent property 'log-async' is used. Default: false. Available only when
                       Console log handler is activated.
--log-console-async-queue-length <queue-length>
                     The queue length to use before flushing writing when logging to console.
                       Default: 512. Available only when Console log handler is activated and
                       asynchronous logging is enabled.
--log-console-color <true|false>
                     Enable or disable colors when logging to console. If this is not present then
                       an attempt will be made to guess if the terminal supports color. Available
                       only when Console log handler is activated.
--log-console-format <format>
                     The format of unstructured console log entries. If the format has spaces in
                       it, escape the value using "<format>". Default: %d{yyyy-MM-dd HH:mm:ss,SSS} %
                       -5p [%c] (%t) %s%e%n. Available only when Console log handler is activated.
--log-console-include-mdc <true|false>
                     Include mdc information in the console log. If the 'log-console-format' option
                       is specified, this option has no effect. Default: true. Available only when
                       Console log handler and MDC logging are activated.
--log-console-include-trace <true|false>
                     Include tracing information in the console log. If the 'log-console-format'
                       option is specified, this option has no effect. Default: true. Available
                       only when Console log handler and Tracing is activated.
--log-console-json-format <format>
                     Set the format of the produced JSON. Possible values are: default, ecs.
                       Default: default. Available only when Console log handler is activated and
                       output is set to 'json'.
--log-console-level <level>
                     Set the log level for the console handler. It specifies the most verbose log
                       level for logs shown in the output. It respects levels specified in the
                       'log-level' option, which represents the maximal verbosity for the whole
                       logging system. For more information, check the Logging guide. Possible
                       values are (case insensitive): off, fatal, error, warn, info, debug, trace,
                       all. Default: all. Available only when Console log handler is activated.
--log-console-output <output>
                     Set the log output to JSON or default (plain) unstructured logging. Possible
                       values are: default, json. Default: default. Available only when Console log
                       handler is activated.
--log-file <file>    Set the log file path and filename. Default: data/log/keycloak.log. Available
                       only when File log handler is activated.
--log-file-async <true|false>
                     Indicates whether to log asynchronously to file log. If not set, value from
                       the parent property 'log-async' is used. Default: false. Available only when
                       File log handler is activated.
--log-file-async-queue-length <queue-length>
                     The queue length to use before flushing writing when logging to file log.
                       Default: 512. Available only when File log handler is activated and
                       asynchronous logging is enabled.
--log-file-format <format>
                     Set a format specific to file log entries. Default: %d{yyyy-MM-dd HH:mm:ss,
                       SSS} %-5p [%c] (%t) %s%e%n. Available only when File log handler is
                       activated.
--log-file-include-mdc <true|false>
                     Include MDC information in the file log. If the 'log-file-format' option is
                       specified, this option has no effect. Default: true. Available only when
                       File log handler and MDC logging are activated.
--log-file-include-trace <true|false>
                     Include tracing information in the file log. If the 'log-file-format' option
                       is specified, this option has no effect. Default: true. Available only when
                       File log handler and Tracing is activated.
--log-file-json-format <format>
                     Set the format of the produced JSON. Possible values are: default, ecs.
                       Default: default. Available only when File log handler is activated and
                       output is set to 'json'.
--log-file-level <level>
                     Set the log level for the file handler. It specifies the most verbose log
                       level for logs shown in the output. It respects levels specified in the
                       'log-level' option, which represents the maximal verbosity for the whole
                       logging system. For more information, check the Logging guide. Possible
                       values are (case insensitive): off, fatal, error, warn, info, debug, trace,
                       all. Default: all. Available only when File log handler is activated.
--log-file-output <output>
                     Set the log output to JSON or default (plain) unstructured logging. Possible
                       values are: default, json. Default: default. Available only when File log
                       handler is activated.
--log-level <category:level>
                     The log level of the root category or a comma-separated list of individual
                       categories and their levels. For the root category, you don't need to
                       specify a category. Default: info.
--log-level-<category> <level>
                     The log level of a category. Takes precedence over the 'log-level' option.
                       Possible values are (case insensitive): off, fatal, error, warn, info,
                       debug, trace, all.
--log-mdc-keys <keys>
                     Defines which information should be added to the mapped diagnostic context as
                       a comma-separated list. Possible values are: realmName, clientId, userId,
                       ipAddress, org, sessionId, authenticationSessionId, authenticationTabId.
                       Default: realmName,clientId,org,sessionId,authenticationSessionId,
                       authenticationTabId. Available only when MDC logging is enabled.
--log-syslog-app-name <name>
                     Set the app name used when formatting the message in RFC5424 format. Default:
                       keycloak. Available only when Syslog is activated.
--log-syslog-async <true|false>
                     Indicates whether to log asynchronously to Syslog. If not set, value from the
                       parent property 'log-async' is used. Default: false. Available only when
                       Syslog is activated.
--log-syslog-async-queue-length <queue-length>
                     The queue length to use before flushing writing when logging to Syslog.
                       Default: 512. Available only when Syslog is activated and asynchronous
                       logging is enabled.
--log-syslog-counting-framing <strategy>
                     If 'true', the message being sent is prefixed with the size of the message. If
                       'protocol-dependent', the default value is 'true' when 'log-syslog-protocol'
                       is 'tcp' or 'ssl-tcp', otherwise 'false'. Possible values are: true, false,
                       protocol-dependent. Default: protocol-dependent. Available only when Syslog
                       is activated.
--log-syslog-endpoint <host:port>
                     Set the IP address and port of the Syslog server. Default: localhost:514.
                       Available only when Syslog is activated.
--log-syslog-format <format>
                     Set a format specific to Syslog entries. Default: %d{yyyy-MM-dd HH:mm:ss,SSS} %
                       -5p [%c] (%t) %s%e%n. Available only when Syslog is activated.
--log-syslog-include-mdc <true|false>
                     Include MDC information in the Syslog. If the 'log-syslog-format' option is
                       specified, this option has no effect. Default: true. Available only when
                       Syslog handler and MDC logging are activated.
--log-syslog-include-trace <true|false>
                     Include tracing information in the Syslog. If the 'log-syslog-format' option
                       is specified, this option has no effect. Default: true. Available only when
                       Syslog handler and Tracing is activated.
--log-syslog-json-format <format>
                     Set the format of the produced JSON. Possible values are: default, ecs.
                       Default: default. Available only when Syslog is activated and output is set
                       to 'json'.
--log-syslog-level <level>
                     Set the log level for the Syslog handler. It specifies the most verbose log
                       level for logs shown in the output. It respects levels specified in the
                       'log-level' option, which represents the maximal verbosity for the whole
                       logging system. For more information, check the Logging guide. Possible
                       values are (case insensitive): off, fatal, error, warn, info, debug, trace,
                       all. Default: all. Available only when Syslog is activated.
--log-syslog-max-length <max-length>
                     Set the maximum length, in bytes, of the message allowed to be sent. The
                       length includes the header and the message. If not set, the default value is
                       2048 when 'log-syslog-type' is rfc5424 (default) and 1024 when
                       'log-syslog-type' is rfc3164. Available only when Syslog is activated.
--log-syslog-output <output>
                     Set the Syslog output to JSON or default (plain) unstructured logging.
                       Possible values are: default, json. Default: default. Available only when
                       Syslog is activated.
--log-syslog-protocol <protocol>
                     Set the protocol used to connect to the Syslog server. Possible values are:
                       tcp, udp, ssl-tcp. Default: tcp. Available only when Syslog is activated.
--log-syslog-type <type>
                     Set the Syslog type used to format the sent message. Possible values are:
                       rfc5424, rfc3164. Default: rfc5424. Available only when Syslog is activated.

Telemetry (OpenTelemetry):

--telemetry-endpoint <url>
                     OpenTelemetry endpoint to connect to. Default: http://localhost:4317.
                       Available only when any of available OpenTelemetry components (Logs, Traces)
                       is turned on.
--telemetry-logs-endpoint <url>
                     Telemetry (OpenTelemetry) endpoint to export logs to. If not given, the value
                       is inherited from the 'telemetry-endpoint' option. Available only when
                       Telemetry Logs functionality ('telemetry-logs-enabled') is enabled.
--telemetry-logs-level <level>
                     The most verbose log level exported to the telemetry endpoint. For more
                       information, check the Telemetry guide. Possible values are (case
                       insensitive): off, fatal, error, warn, info, debug, trace, all. Default:
                       all. Available only when Telemetry Logs functionality
                       ('telemetry-logs-enabled') is enabled.
--telemetry-logs-protocol <protocol>
                     Telemetry (OpenTelemetry) protocol used for exporting logs. If not given, the
                       value is inherited from the 'telemetry-protocol' option. Possible values
                       are: grpc, http/protobuf. Available only when Telemetry Logs functionality
                       ('telemetry-logs-enabled') is enabled.
--telemetry-protocol <protocol>
                     OpenTelemetry protocol used for the communication between server and
                       OpenTelemetry collector. Possible values are: grpc, http/protobuf. Default:
                       grpc. Available only when any of available OpenTelemetry components (Logs,
                       Traces) is turned on.
--telemetry-resource-attributes <attributes>
                     OpenTelemetry resource attributes characterize the telemetry producer. Values
                       in format 'key1=val1,key2=val2'. Available only when any of available
                       OpenTelemetry components (Logs, Traces) is turned on.
--telemetry-service-name <name>
                     OpenTelemetry service name. Takes precedence over 'service.name' defined in
                       the 'telemetry-resource-attributes' property. Default: keycloak. Available
                       only when any of available OpenTelemetry components (Logs, Traces) is turned
                       on.

Tracing:

--tracing-compression <method>
                     OpenTelemetry compression method used to compress payloads. If unset,
                       compression is disabled. Possible values are: gzip, none. Default: none.
                       Available only when Tracing is enabled.
--tracing-endpoint <url>
                     OpenTelemetry endpoint to connect to for traces. If not given, the value is
                       inherited from the 'telemetry-endpoint' option. Default: http://localhost:
                       4317. Available only when Tracing is enabled.
--tracing-header-<header> <value>
                     OpenTelemetry header that will be part of the exporter request (mainly useful
                       for providing Authorization header). Check the documentation on how to set
                       environment variables for headers containing special characters or custom
                       case-sensitive headers. Available only when Tracing is enabled.
--tracing-infinispan-enabled <true|false>
                     Enables the OpenTelemetry tracing for embedded Infinispan. Default: true.
                       Available only when tracing and embedded Infinispan is enabled.
--tracing-protocol <protocol>
                     OpenTelemetry protocol used for the telemetry data. If not given, the value is
                       inherited from the 'telemetry-protocol' option. Possible values are: grpc,
                       http/protobuf. Default: grpc. Available only when Tracing is enabled.
--tracing-resource-attributes <attributes>
                     DEPRECATED. OpenTelemetry resource attributes present in the exported trace to
                       characterize the telemetry producer. Values in format 'key1=val1,key2=val2'.
                       If not given, the value is inherited from the
                       'telemetry-resource-attributes' option. For more information, check the
                       Tracing guide. Available only when Tracing is enabled. Resource attributes
                       are not directly related to Tracing and you should use the Telemetry option
                       which takes precedence. Use the following option instead:
                       telemetry-resource-attributes.
--tracing-sampler-ratio <ratio>
                     OpenTelemetry sampler ratio. Probability that a span will be sampled. Expected
                       double value in interval [0,1]. Default: 1.0. Available only when Tracing is
                       enabled.
--tracing-service-name <name>
                     DEPRECATED. OpenTelemetry service name. Takes precedence over 'service.name'
                       defined in the 'tracing-resource-attributes' property. If not given, the
                       value is inherited from the 'telemetry-service-name' option. Default:
                       keycloak. Available only when Tracing is enabled. Service name is not
                       directly related to Tracing and you should use the Telemetry option which
                       takes precedence. Use the following option instead: telemetry-service-name.

Events:

--event-metrics-user-events <events>
                     Comma-separated list of events to be collected for user event metrics. This
                       option can be used to reduce the number of metrics created as by default all
                       user events create a metric. Possible values are:<...>
--event-metrics-user-tags <tags>
                     Comma-separated list of tags to be collected for user event metrics. By
                       default only 'realm' is enabled to avoid a high metrics cardinality.
                       Possible values are: realm, idp, clientId. Default: realm. Available only
                       when user event metrics are enabled.

Truststore:

--tls-hostname-verifier <tls-hostname-verifier>
                     The TLS hostname verification policy for out-going HTTPS and SMTP requests.
                       ANY should not be used in production. Possible values are: ANY, WILDCARD
                       (deprecated), STRICT (deprecated), DEFAULT. Default: DEFAULT.
--truststore-paths <truststore-paths>
                     List of pkcs12 (p12, pfx, or pkcs12 file extensions), PEM files, or
                       directories containing those files that will be used as a system truststore.

Bootstrap Admin:

--bootstrap-admin-client-id <client id>
                     Client id for the temporary bootstrap admin service account. Used only when
                       the master realm is created. Available only when bootstrap admin client
                       secret is set. Default: temp-admin.
--bootstrap-admin-client-secret <client secret>
                     Client secret for the temporary bootstrap admin service account. Used only
                       when the master realm is created. Use a non-CLI configuration option for
                       this option if possible.
--bootstrap-admin-password <password>
                     Temporary bootstrap admin password. Used only when the master realm is
                       created. Use a non-CLI configuration option for this option if possible.
--bootstrap-admin-username <username>
                     Temporary bootstrap admin username. Used only when the master realm is
                       created. Available only when bootstrap admin password is set. Default:
                       temp-admin.

By default, this command tries to update the server configuration by running a
'build' before starting the server. You can disable this behavior by using the
'--optimized' option:

      $ kc.sh start '--optimized'

By doing that, the server should start faster based on any previous
configuration you have set when manually running the 'build' command.