---
title: "Keycloak SMTP settings for realm email"
description: "Realm settings → Email: host, port, Enable StartTLS for 587, then Test connection to your own address."
url: https://www.unitpost.com/docs/smtp/keycloak
section: SMTP
updated: 2026-11-02
---
# Keycloak SMTP settings for realm email

## Connection settings

- **Host**: smtp.unitpost.com
- **Username**: unitpost (always this literal value)
- **Password**: Your Unitpost API key (must carry emails:send)
- **Port (STARTTLS)**: 587 (or 2587 if blocked, or 25)
- **Port (implicit TLS)**: 465 (or 2465 if blocked)
- **Security**: TLS 1.2 or 1.3 (required before AUTH)
- **From address**: Any address on a verified domain

## Keycloak SMTP settings for realm email

> Realm settings → Email: host, port, Enable StartTLS for 587, then Test connection to your own address.

Keycloak sends verify-email, password-reset and other login-flow emails with the SMTP settings on each realm's Email tab. Every realm has its own settings, so filling them in on `master` does nothing for your app's realm. Test connection mails the signed-in admin, and asks you to add an email address to that admin first if it has none.

### 1. Create a send-only key

In Unitpost, open Settings → SMTP and create a send-only key. Keycloak's From field needs an address on a verified domain (/docs/domains).

### 2. Open the realm's Email tab

In the admin console, switch to the realm your app signs in to, click Realm settings, then the Email tab.

### 3. Enter the connection

- From: no-reply@yourdomain.com
- From display name: Your app
- Host: smtp.unitpost.com
- Port: 587
- Encryption: Enable StartTLS
- Authentication: On
- Username: unitpost
- Authentication Type: Password
- Password: Your Unitpost API key

> For port 465, tick Enable SSL instead of Enable StartTLS. With neither ticked, Keycloak tries to log in before TLS and Unitpost answers `538`.

### 4. Save and test the connection

Click Save, then Test connection. Keycloak sends a message to the email address of the admin you're signed in as and reports success or the SMTP error. Realm settings apply on save, with nothing to restart.

### 5. If the test fails

`535 5.7.8` means Username isn't `unitpost`. `550 5.7.1` means From isn't on a verified domain. A timeout on 465 means Enable StartTLS is ticked where Enable SSL belongs.

## Related

- [Set up Strapi email over SMTP](https://www.unitpost.com/docs/smtp/strapi): @strapi/provider-email-nodemailer in config/plugins, then fix the Users & Permissions shipper email.
- [Configure n8n SMTP for invites and password resets](https://www.unitpost.com/docs/smtp/n8n): N8N_SMTP_* environment variables with N8N_SMTP_SSL=false for port 587, then invite a user to test.
- [Grafana SMTP settings for alert email](https://www.unitpost.com/docs/smtp/grafana): The smtp section of grafana.ini: host and port in one value, MandatoryStartTLS, and a contact point test.