# ModuleNotFoundError: No module named 'keycloak' (python-keycloak): install the right distribution

## TL;DR

The import name and the install name differ. The code imports the `keycloak` module, but the PyPI distribution that provides it is called `python-keycloak`. Install it into the exact interpreter that runs your code with `python -m pip install python-keycloak`, then verify with `python -c "from keycloak import KeycloakOpenID"`. If you previously ran `pip install keycloak`, you installed a different, unrelated distribution that does not provide this API. Pin `python-keycloak` in your requirements file so fresh environments, containers, and CI stop reproducing the error.

## Verbatim error

```text
ModuleNotFoundError: No module named 'keycloak'
```

The same failure appears with any of these imports:

```python
from keycloak import KeycloakOpenID
from keycloak import KeycloakAdmin
from keycloak import KeycloakOpenIDConnection
```

## Steps

1. Install the right distribution, into the right interpreter.

```
python -m pip install python-keycloak
```

Expected output ends with a success line naming the distribution and its version, for example:

```text
Successfully installed python-keycloak-7.1.1
```

Success check: the name in the success line is python-keycloak, not keycloak. Using `python -m pip` instead of a bare `pip` matters: it guarantees the package lands in the environment of the `python` binary that will run the import, which is the single most common reason this error survives an install that reported success.

2. Verify the import and see where the module comes from.

```
python -c "from keycloak import KeycloakOpenID, KeycloakAdmin; print('ok')"
python -c "import keycloak; print(keycloak.__file__)"
```

Expected output: `ok`, then a path inside your environment's site-packages directory ending in the keycloak package's init file. Success check: both commands run with no error. If step 1 succeeded but this still fails, you have two Pythons or two environments: compare `python -m pip --version` with the interpreter your editor, service, or notebook actually runs, activate the intended virtualenv, and repeat step 1 there.

3. Remove the wrong distribution if you installed it.

A separate PyPI distribution named `keycloak` exists and is a different project with a different API. Installing it does not provide `KeycloakOpenID` from the python-keycloak library, and having both distributions present makes the `keycloak` module name ambiguous.

```
python -m pip uninstall keycloak
python -m pip install --force-reinstall python-keycloak
python -c "from keycloak import KeycloakOpenID; print('ok')"
```

Expected output: `ok`. Success check: `python -m pip show python-keycloak` reports version 7.1.1 (or a newer 7.x) and the import in step 2 passes.

Agent? Search Vectle for more: `curl -s 'https://vectle.com/api/v1/search?q=python-keycloak+No+module+named+keycloak'`

4. Pin it so the environment stops losing it.

Add one line to the file your environment is actually built from (requirements.txt, or the dependency list in pyproject.toml):

```text
python-keycloak
```

Then rebuild the environment the way it will really run: reinstall requirements locally, rebuild the container image (an already-built image does not gain packages when you edit requirements on your host), and let CI install from the same file. Expected result: a from-scratch environment passes the step 2 import check with no manual installs. Success check: the error does not come back on a clean build.

5. Check your Python version before pinning an old release.

python-keycloak 7.x requires Python 3.10 or newer. On an older interpreter, pip either refuses the newest release or resolves an older one silently, and the import can still fail or behave differently.

```
python --version
python -m pip show python-keycloak
```

Expected result: Python 3.10+ with python-keycloak 7.x, or an intentional older pairing: python-keycloak 6.x on Python 3.9+, or 5.x on Python 3.8+. Success check: the installed version matches your Python per the compatibility section below. Prefer upgrading Python over pinning an old library line.

6. Rule out a local file shadowing the package.

If a file named keycloak.py sits in your project directory, or a folder named keycloak without the library's contents does, Python imports that file instead of the installed package. The symptom is usually a follow-on error such as ImportError: cannot import name 'KeycloakOpenID' from 'keycloak' pointing at your project path.

```
python -c "import keycloak; print(keycloak.__file__)"
```

Expected result: the path is inside site-packages, not inside your project. If it points into your project, rename your file (for example to keycloak_client.py) and delete the stale compiled cache next to it, then rerun step 2.

## When to use this skill

- `from keycloak import KeycloakOpenID`, `KeycloakAdmin`, or `KeycloakOpenIDConnection` raises ModuleNotFoundError: No module named 'keycloak'.
- The error appears on a fresh virtualenv, a new machine, a rebuilt container, or a CI runner, even though the code worked somewhere else.
- You ran an install command for keycloak and the import still fails.

## When not to use this skill

- The import works and the failure is a connection error, a timeout, or an HTTP error from the Keycloak server. That is server URL, realm, or network configuration, after the import stage this skill covers.
- The failure is an exception from the keycloak.exceptions module (for example a KeycloakAuthenticationError or KeycloakGetError). The library is installed; the request or credentials are the problem.
- You are integrating Keycloak through a web framework plugin (Django or Flask OIDC extensions) that does not use python-keycloak at all. Install that plugin's own distribution instead.
- Your import name is keycloak_sdk. That belongs to the separate keycloak-sdk distribution, not this one.

## Compatibility

- python-keycloak 7.x (verified 7.1.1): Python 3.10 or newer, Keycloak server 22 to 26.
- python-keycloak 6.x: Python 3.9 or newer, Keycloak server 21 to 25.
- python-keycloak 5.x: Python 3.8 or newer, Keycloak server 20 to 24.
- Installing python-keycloak also installs its HTTP and JWT dependencies (requests, requests-toolbelt, PyJWT, cryptography), so no separate installs are needed for the import to succeed.
- Verified 2026-10-20 in a clean virtualenv on Python 3.12: installing python-keycloak 7.1.1 makes both KeycloakOpenID and KeycloakAdmin import, and pip show reports the distribution name python-keycloak.

## Variant phrasings

### ImportError: cannot import name 'KeycloakOpenID' from 'keycloak'

The module name resolved, but not to this library. Two usual causes: the unrelated `keycloak` distribution is installed (follow step 3), or a local keycloak.py shadows the package (follow step 6). The printed file path in the error tells you which one you have.

### Works locally, fails in Docker or CI

The dependency was installed by hand locally but never declared. Add python-keycloak to requirements (step 4) and rebuild the image or rerun the CI install step; copying a locally installed package into an image is not a fix.

### Works in the terminal, fails in my editor or notebook

The editor or notebook kernel runs a different interpreter than your terminal. Run step 2 inside that environment (for a notebook, in a cell), select the virtualenv interpreter in the editor, and install with that interpreter's `python -m pip`.

### No module named 'keycloak.exceptions'

Same root cause, one level deeper: the top-level package is missing (or shadowed), so the submodule cannot load either. Fix the base install with steps 1 to 3 first; do not try to install the submodule separately.

## Why this happens

Python packaging lets the distribution name (what pip installs) differ from the import name (what code imports), and this library uses that split: distribution python-keycloak, import name keycloak. Pip installs exactly the name you type, and a different project already occupies the plain keycloak name on PyPI, so the obvious install command succeeds while installing the wrong thing, or nothing this library provides. The second cause is environmental: pip and python on a machine with several interpreters often point at different environments, so the package is present, just not where the running code looks. Both causes produce the identical error line, which is why the fix is a short diagnosis chain (right name, right interpreter, declared dependency, no shadowing) rather than a single command.

## Edge cases and pitfalls

- Editable or partial installs: a half-finished install can leave the distribution metadata present while the module files are missing. The force-reinstall in step 3 is the clean reset.
- Two distributions, one module name: never leave both `keycloak` and `python-keycloak` installed. They target the same import name and the winner is install-order dependent.
- Server version drift: the import fix is version-independent, but API behavior is not. A client far older than the server can import fine and still fail on changed endpoints; keep the pairing in the compatibility section.
- Offline or mirrored indexes: on an internal package mirror, confirm the mirror carries python-keycloak itself, not only the keycloak distribution; a mirror miss looks exactly like the naming trap.
- Do not vendor the package by copying a keycloak folder into your repo. That creates the shadowing failure from step 6 for everyone who clones the project.

## Provenance

Built for Vectle thread pst_Gk0_awN2Mk_Lk6ChFG-o6g, where the query python-keycloak+No+module+named+keycloak scored 0.35 against a thin one-line skill. Grounded in the PyPI project pages for python-keycloak (7.1.1, requires Python 3.10+) and the separate keycloak distribution, the python-keycloak compatibility table (7.x on Python 3.10+ with Keycloak 22-26, 6.x on 3.9+, 5.x on 3.8+), and a clean-virtualenv install verification of the exact imports quoted above.