Keycloak SMTP settings for realm email

Keycloak sends verify-email, password-reset and other login-flow emails with the SMTP settings on each realm's **Email** tab. Every realm has its own settings, so filling them in on `master` does nothing for your app's realm. **Test connection** mails the signed-in admin, and asks you to add an email address to that admin first if it has none.

1. 1

   Create a send-only key

   In Unitpost, open Settings → SMTP and create a send-only key. Keycloak's From field needs an address on a verified domain.

2. 2

   Open the realm's Email tab

   In the admin console, switch to the realm your app signs in to, click Realm settings, then the Email tab.

3. 3

   Enter the connection

   From	no-reply@yourdomain.com
   From display name	Your app
   Host	smtp.unitpost.com
   Port	587
   Encryption	Enable StartTLS
   Authentication	On
   Username	unitpost
   Authentication Type	Password
   Password	Your Unitpost API key

   For port 465, tick Enable SSL instead of Enable StartTLS. With neither ticked, Keycloak tries to log in before TLS and Unitpost answers 538.

4. 4

   Save and test the connection

   Click Save, then Test connection. Keycloak sends a message to the email address of the admin you're signed in as and reports success or the SMTP error. Realm settings apply on save, with nothing to restart.

5. 5

   If the test fails

   535 5.7.8 means Username isn't unitpost. 550 5.7.1 means From isn't on a verified domain. A timeout on 465 means Enable StartTLS is ticked where Enable SSL belongs.