> Auto-generated markdown. For the original HTML, request the same URL without `Accept: text/markdown`, removing any `.index.md` or `/index.md` suffix.
[Skip to content](#content)
[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https://www.keycloak-saas.com/en/keycloak-26-8-new-features "Share on Facebook")
[Share on X](https://x.com/intent/post?url=https://www.keycloak-saas.com/en/keycloak-26-8-new-features "Share on X")
[Share on Pinterest](https://pinterest.com/pin/create/link/?url=https://www.keycloak-saas.com/en/keycloak-26-8-new-features "Share on Pinterest")
[Share on LinkedIn](https://www.linkedin.com/shareArticle?mini=true&url=https://www.keycloak-saas.com/en/keycloak-26-8-new-features "Share on LinkedIn")
# Keycloak 26.8: the 5 main new features of the latest Version
**\[INDEX\]**
1. 1. [Automatic User and Group Provisioning via SCIM APIs (Supported)](#int)
2. [Simplified Multi-Cluster Management with Stateless Architecture (Supported)](#ges)
3. [Token Exchange and Access Delegation for AI Agents and External Applications (Preview)](#token)
4. [Verifiable Digital Credentials: New Features for the OID4VCI and OID4VP Standards](#vantaggi)
5. [Greater Reliability in Brute-Force Attack Protection and SAML SLO Fix in Keycloak 26.8.1](#compl)
6. [Yookey: the IAM Solution Based on Keycloak with SPID and CIE](#yookey)
The **Keycloak 26.8** release introduces significant improvements in **digital identity and access management (IAM, Identity and Access Management)**. The new features mainly concern the evolution of the architecture for cloud-native environments, the integration of open standards for user provisioning and verifiable credentials, as well as new security features designed to support increasingly complex use cases, including those involving artificial intelligence agents.
Here are the **5 main new features in Keycloak 26.8** and their implications for identity management, automation and access protection.
## 1\. Automatic User and Group Provisioning via SCIM APIs (Supported)
With Keycloak 26.8, support for the **SCIM (System for Cross-domain Identity Management) standard** for user and group management becomes officially available.
This functionality makes it possible **to automate identity synchronization between Keycloak and external systems**, such as HR platforms and Identity Governance solutions. It is therefore possible to manage user account creation, updates and deactivation centrally and automatically.
### 2\. Simplified Multi-Cluster Management with Stateless Architecture (Supported)
The **new stateless mode** (_–features=stateless_) is introduced as an officially supported feature and allows multiple Keycloak clusters to be connected using the database to persist sessions.
This approach **reduces infrastructure complexity** by eliminating the need to configure cross-site replication of an external Infinispan instance. At the same time, the **previous multi-cluster v1 architecture** is deprecated, promoting a deployment model that is easier to manage.
[Contact us](https://www.keycloak-saas.com/en/contacts.index.md)
###### Ready-Made Templates
Looking for an IAM or IGA platform to manage digital identities?
Visit the Yookey website to discover the available solutions.
### 3\. Token Exchange and Access Delegation for AI Agents and External Applications (Preview)
Keycloak 26.8 introduces **preview functionality for access delegation** through the parameterized scope delegation:client:. This mechanism allows users to authorize AI agents and third-party applications to access permitted resources through an **OAuth-based consent flow.**
The issued tokens include the act claim, which identifies the **delegation context**. The feature also includes an explicit restriction: delegated tokens **cannot be used** **to access Keycloak Admin APIs**. This restriction helps prevent privilege escalation and maintain a separation between user permissions and those of delegated applications.
### 4\. Verifiable Digital Credentials: New Features for the OID4VCI and OID4VP Standards
The release expands support for verifiable digital credentials by introducing preview functionality based on the **OpenID for Verifiable Credential Issuance (OID4VCI) standard.** The update makes it possible to manage the credential lifecycle, including revocation mechanisms integrated with **refresh tokens and key attestation capabilities.**
These new features are complemented by experimental support **for verifying credentials** presented through digital wallets during authentication processes, based on the OpenID for Verifiable Presentations (OID4VP) standard. This development expands Keycloak’s integration possibilities with **digital identity systems based on verifiable credentials.**
### 5\. Greater Reliability in Brute-Force Attack Protection and SAML SLO Fix in Keycloak 26.8.1
Among the security improvements, Keycloak 26.8 introduces **database persistence for data relating** to lockouts resulting from repeated failed authentication attempts. This setting, enabled by default, makes it possible **to retain lockout information** even after cluster nodes restart, preventing the protection state from being lost due to a service interruption.
The Keycloak 26.8.1 patch also includes a **security fix related to the SAML Single Logout (SLO) protocol**. The fix prevents a client from improperly terminating sessions associated with other applications, strengthening isolation between different authentication contexts and **improving the overall security of session management.**
### Yookey: the IAM Solution Based on Keycloak with SPID and CIE
**Yookey** is an **Identity and Access Management (IAM) solution based on Keycloak** that ensures robust and secure management of digital identities and access control to resources and services.
The solution simplifies and secures onboarding and offboarding processes through **integration with Single Sign-On (SSO)** and **advanced access management automation**, while applying **multi-factor authentication (MFA)** mechanisms to strengthen security from the very first login.
Yookey integrates natively with **YooPoint, the IGA (Identity Governance and Administration)** software within the E-time Suite, enabling the management of the entire digital identity lifecycle.
Enable authentication via SSO and MFA
Speak directly with our team for more information.
[Contact us](https://www.keycloak-saas.com/en/contacts.index.md)
##### [Carla](https://www.keycloak-saas.com/en/author/carla.index.md)
29674