Embedded browser compatibility
Understand blocked redirects, passkeys and downloads.
The embedded console permits the active tunnel origin. A navigation or resource that escapes that origin is blocked. This prevents the app from silently sending the administration session to an arbitrary website.
External identity providers, domain-bound passkeys, popup windows, file downloads and resources hosted on a different origin are outside the supported embedded-browser workflow. A server configuration that forces the public hostname can also prevent the local tunnel view from loading.
Use a compatible private HTTP Keycloak route behind SSH. An authorized administrator can review the hostname, proxy headers, base path and loopback configuration using the setup guide. Do not expose the administration service to the public internet or disable certificate checks to make a test pass.
If your required login flow depends on an unsupported browser feature, use a regular browser and a separately secured connection under your organization’s policy. The app does not promise every customized Keycloak theme or extension works.