# Is it possible to run an instance of Keycloak for multiple websites with different hostnames? **URL:** \ **Category:** Getting advice\ **Tags:** authentication, oidc\ **Created:** [December 19, 2022, 2:09pm UTC](https://forum.keycloak.org/t/is-it-possible-to-run-an-instance-of-keycloak-for-multiple-websites-with-different-hostnames/19205 "2022-12-19T14:09:24Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Nefcanto](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/nefcanto/32/3670_2.png) [@Nefcanto](https://forum.keycloak.org/u/Nefcanto)\ **Post date:** [December 19, 2022, 2:09pm UTC](https://forum.keycloak.org/t/is-it-possible-to-run-an-instance-of-keycloak-for-multiple-websites-with-different-hostnames/19205/1 "2022-12-19T14:09:24Z")
We are a website design agency. This means that we create many many websites and web applications per year for our customers. We were using a home-built security solution. But we could not keep up with the security requirements. We think of migrating out entire security to Keycloak. We have implemented Keycloak for some of our products successfully. So this is our division architecture for each website or web application: [example.com](http://example.com) =\> a Next.js or Qwik website [api.example.com](http://api.example.com) =\> API to serve the website [accounts.example.com](http://accounts.example.com) =\> instance of Keycloak [admin.example.com](http://admin.example.com) =\> our admin panel (React) [api.admin.example.com](http://api.admin.example.com) =\> the API to serve our admin panel [client.example.com](http://client.example.com) =\> a panel to be used by customers of our customer [api.client.example.com](http://api.client.example.com) =\> the API to serve our client panel … Now there is a serious problem here with scaling. Each Keycloak instance would take as much as 700 MB of RAM. Even the new shift to Quarkus takes at least 300 MB. This hugely reduces our ability to deploy one Keycloak instance per customer. However, Keycloak has the concept of realms, which in essence is the multitenancy architecture. This is good news for us. This means that we can use `accounts.our-company.com` as the single identity management access point for all or our customers, `example1.com`, `example2.net`, `another-site.another-tld`. But we lose branding here. We would love to have `accounts.our-customer-domain.tld` as the accounts management subdomain. So, this is the question I have. Is it possible to make that `KC_HOSTNAME` dynamic? In other words, is it possible to have one Keycloak instance serving on different hostnames? ---
**Author:** ![Carl](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/carl/32/10443_2.png) [@Carl](https://forum.keycloak.org/u/Carl)\ **Post date:** [December 19, 2022, 3:36pm UTC](https://forum.keycloak.org/t/is-it-possible-to-run-an-instance-of-keycloak-for-multiple-websites-with-different-hostnames/19205/2 "2022-12-19T15:36:47Z")
Can you provide each user with a branded Keycloak theme? You can provide each with a login page that uses customer-specific graphics. That way you can stick to the one customer-per-realm design. ---
**Author:** ![Nefcanto](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/nefcanto/32/3670_2.png) [@Nefcanto](https://forum.keycloak.org/u/Nefcanto)\ **Post date:** [December 19, 2022, 5:51pm UTC](https://forum.keycloak.org/t/is-it-possible-to-run-an-instance-of-keycloak-for-multiple-websites-with-different-hostnames/19205/3 "2022-12-19T17:51:56Z")
That definitely helps. Users of `exampe1.com` with red theme would see a red login page and users from `example2.net` with blue theme would see a blue login page. But if they both look up, they both see `accounts.main-domain.com`. Since we’re selling websites to our customers, they panic if they see that their user accounts are not **on** their main domain. We want users of `x.tld` to see `accounts.x.tld` when they are redirected to this single Keycloak instance. Then behind the scenes, they would be using a different realm. ---
**Author:** ![melancholia](https://avatars.discourse-cdn.com/v4/letter/m/dbc845/32.png) [@melancholia](https://forum.keycloak.org/u/melancholia)\ **Post date:** [December 19, 2022, 5:59pm UTC](https://forum.keycloak.org/t/is-it-possible-to-run-an-instance-of-keycloak-for-multiple-websites-with-different-hostnames/19205/4 "2022-12-19T17:59:33Z")
I’ve never tried it – perhaps you can proxy? Traffic → customer 1 --proxy as [example1.com](http://example1.com) → to [accounts.our-company.com/realm1](http://accounts.our-company.com/realm1) Traffic → customer 2 --proxy as [example2.com](http://example2.com) → to [accounts.our-company.com/realm2](http://accounts.our-company.com/realm2) The proxy in Apache, or whichever you may select to have, resolves the customers domain, and all else under the hoods are proxied to the appropriate realm (who’s ‘real’ domain is never seen outside of your network borders). ---
**Author:** ![Nefcanto](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/nefcanto/32/3670_2.png) [@Nefcanto](https://forum.keycloak.org/u/Nefcanto)\ **Post date:** [December 19, 2022, 6:02pm UTC](https://forum.keycloak.org/t/is-it-possible-to-run-an-instance-of-keycloak-for-multiple-websites-with-different-hostnames/19205/5 "2022-12-19T18:02:49Z")
That is good advice. Thank you for that. But there is a problem. Keycloak uses `accounts.our-compoany.com` to create a lot of links for redirections. And users would encounter problems when they want to navigate. For example, a user goes to `accounts.example1.com` and sees the red login page. But he does not remember his password and clicks on the **forgot password** link, and what happens then? Based on the docs, user would be redirected to `accounts.our-company.com`. ---
**Author:** ![Carl](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/carl/32/10443_2.png) [@Carl](https://forum.keycloak.org/u/Carl)\ **Post date:** [December 19, 2022, 6:07pm UTC](https://forum.keycloak.org/t/is-it-possible-to-run-an-instance-of-keycloak-for-multiple-websites-with-different-hostnames/19205/6 "2022-12-19T18:07:55Z")
Different clients would handle the redirect [example1.com](http://example1.com) → accounts.our-company/example1-realm → (example1 client) back to [example1.com](http://example1.com) [example2.com](http://example2.com) → accounts.our-company/example2-realm → (example2 client) back to [example2.com](http://example2.com) The clients don’t have to be named to a specific client. That’s just to make the example clearer. [example1.com](http://example1.com) would have to know enough about it’s environment to do the redirect to example1’s custom realm login page. For instance, if no token the pull the domain and use that for the realmId and the clientId ---
**Author:** ![Nefcanto](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/nefcanto/32/3670_2.png) [@Nefcanto](https://forum.keycloak.org/u/Nefcanto)\ **Post date:** [December 19, 2022, 6:17pm UTC](https://forum.keycloak.org/t/is-it-possible-to-run-an-instance-of-keycloak-for-multiple-websites-with-different-hostnames/19205/7 "2022-12-19T18:17:43Z")
I understood. We should implement redirection in our reverse proxy or load balancer ourselves. This seems to be a practical solution. However, since I’m not a Keycloak expert, I don’t know if this results in some sort of problem somewhere or not. For example when clients want to query well-known resources. Or when they want to refresh a token. I would appreciate it a lot if a Keycloak expert or a Keycloak team member would also give us a hint regarding this requirement. ---
**Author:** ![Carl](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/carl/32/10443_2.png) [@Carl](https://forum.keycloak.org/u/Carl)\ **Post date:** [December 19, 2022, 6:26pm UTC](https://forum.keycloak.org/t/is-it-possible-to-run-an-instance-of-keycloak-for-multiple-websites-with-different-hostnames/19205/8 "2022-12-19T18:26:47Z")
Refreshing the token is fine – that’s core Keycloak whether or not you’re doing a multitenancy design There are going to be differences between giving each customer a full Keycloak and deploying a single instance. My customer needs high availability and clustering and it’s not feasible to give each customer their own multi-server infrastructure. ---
**Author:** ![bpedersen2](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/bpedersen2/32/3934_2.png) [@bpedersen2](https://forum.keycloak.org/u/bpedersen2)\ **Post date:** [December 20, 2022, 9:02am UTC](https://forum.keycloak.org/t/is-it-possible-to-run-an-instance-of-keycloak-for-multiple-websites-with-different-hostnames/19205/9 "2022-12-20T09:02:10Z")
You should be able to configure the frontend url per realm (in combination withthe proxy redirecting everything), see e.g. [1] [1] [Stuck: understanding frontendurl/baseurl, and configuring registration pages](http://forum.keycloak.org/t/stuck-understanding-frontendurl-baseurl-and-configuring-registration-pages/4638)