> ## Documentation Index
> Fetch the complete documentation index at: https://docs.authsignal.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Adding MFA to your Keycloak login flow
> Learn how to add MFA to your Keycloak login flow with Authsignal.
## Overview
In this guide, we will demonstrate how to leverage a Keycloak
provider to seamlessly integrate MFA into a traditional username and password login flow using Authsignal's [pre-built UI](/implementation-options/prebuilt-ui/overview),
enhancing security with minimal disruption to the user experience.
The above example can be extended to meet your specific requirements.
## Prerequisites
This guide assumes you have a basic understanding of Keycloak and Authsignal.
If you are new to Keycloak, we recommend you follow the [Keycloak Quickstart](https://www.keycloak.org/getting-started/getting-started-zip)
guide to get up and running.
## Authsignal configuration
Head to the [Authenticators section in the Authsignal Portal](https://portal.authsignal.com/organisations/tenants/authenticators) to configure authenticators.
For this example, we have enabled Authenticator App.
Head to the [API Keys section in the Authsignal Portal](https://portal.authsignal.com/organisations/tenants/api) to get your API keys.
## Keycloak configuration
### Creating a new provider
Download the pre-built
[authsignal-keycloak-\*.jar](https://github.com/authsignal/authsignal-keycloak-providers/packages/2329169)
JAR file. Alternatively, you can build the JAR file yourself using the [GitHub
repository](https://github.com/authsignal/authsignal-keycloak-providers).
Download the [Authsignal (version 2.0+) Java SDK (dependency) JAR
file](https://mvnrepository.com/artifact/com.authsignal/authsignal-java) from Maven.
Copy the JAR files to the /providers/ directory
}
/>
### Configuring the Authsignal Authentication flow
If you have not already created a Keycloak realm, do this by clicking the **Create realm** button
in the Keycloak admin UI (within the Keycloak drop-down menu top left).
After installing the provider JAR files, you'll need to configure Keycloak to use Authsignal for MFA. This section walks through setting up a custom authentication flow that incorporates the Authsignal Authenticator.
To configure the authentication flow:
Inside the subflow which already contains the ‘Username Password Form’, we need to add the Authsignal provider as a step.
If you successfully added the Authsignal .JAR files to the `/providers/` folder in the previous steps, you will see the Authsignal Authenticator listed in the menu - select it to add it to your flow.
Add your Server API secret key and API host.
When **Enroll by default** is toggled on, users will be prompted to enroll an authenticator when they first log in.
If toggled off, the user will not be prompted to enroll an authenticator, and you will need to handle [enrollment
programmatically](/advanced-usage/programmatic-authenticator-management).
Finally, click the Action -> Bind flow button. Select the `browser` flow to enable the new Authsignal flow.
## Conclusion
That's it! You've successfully added MFA to your Keycloak login flow using Authsignal.
To test the flow, log in and you will be prompted to enroll an authenticator.
The next time you log in, you will be prompted to complete an MFA challenge.
Want to use Keycloak groups and roles in your authentication rules? See the [Groups and Roles
guide](./keycloak-groups-roles) for instructions on setting this up.
When **Enroll by default** is toggled on, users will be prompted to enroll an authenticator when they first log in.
If toggled off, the user will not be prompted to enroll an authenticator, and you will need to handle [enrollment
programmatically](/advanced-usage/programmatic-authenticator-management).