KeepassXC is a great open source password manager, and it can integrate with browsers through its browser extension to auto fill entries.
Many will use Flatpak versions of KeepassXC and their browser, since Flatpaks are often more up to date than the packes of many (mostly debian based) distributions. But since Flatpak is isolating applications the linking between KeepassXC and the browser add-on doesn’t work out of the box. This is a guide to fix this.

How to make flatpaks talk

Flatpaks are sandboxed applications. They should not be able to talk with each other. To create an exception for KeePassXC and your browser follow these steps:

Permissions

Applications may talk through portals with each other, but by default flatpak applications can not access each others portals. Luckily only the browser will need to access the endpoint of KeepassXC, so you can use an application like Flatseal to add a filesystem permission. Use the following: “xdg-run/app/org.keepassxc.KeePassXC:ro”. This will allow read access to the keepass endpoint.
With Firefox this might already work. If you use another Firefox derivation like LibreWolf, like I do, then you will need to teach that browser how to talk with KeePassXC too. Follow the rest of the guide.

Telling a browser how to talk with KeePassXC

The configuration of LibreWolf is stored at “~/.var/app/io.gitlab.librewolf-community/.librewolf/” by default, but doesn’t have a native messaging host, which is needed for communication with KeePassXC. So create a folder “native-messaging-hosts” in that configuration directory.
In the newly created directory you must now put a configuration file for the browser add on, so it can later use the native messaging proxy we will add later. The file should be named like this: “org.keepassxc.keepassxc_browser.json” and contain the following:

{
    "allowed_extensions": [
        "keepassxc-browser@keepassxc.org"
    ],
    "description": "KeePassXC integration with native messaging support, workaround for flatpaked Librewolf",
    "name": "org.keepassxc.keepassxc_browser",
    "path": "/home/<your username>/.var/app/io.gitlab.librewolf-community/.librewolf/native-messaging-hosts/keepassxc-proxy",
    "type": "stdio"
}

Now to the proxy. There is a rust based implementation of the needed proxy. This can be found on GitHub. You will need to clone the repository and build from source. For that you will need cargo and rustup installed.
Since the proxy will need to be run in a flatpak, we will build it with all dependencies included. Todo this first run rustup target add x86_64-unknown-linux-musl. Then run cargo like this: RUSTFLAGS='-C link-arg=-s' cargo build --release --target x86_64-unknown-linux-musl in the repository root. Note that you will have to change the command if you are not using an x86 machine. Now find the binary file in the target directory and move it into the native messaging hosts directory of LibreWolf. Make sure to name it “keepassxc-proxy” or adjust your .json file found above.

You are done, but there are some quirks.

Now your setup should work and the browser extension should be able to connect to the flatpaked KeePassXC. To test that close both your browser and KeePassXC and then first start KeePassXC and then your browser. If you do it in the opposite order the connection will probably not be established.
Because of this little quirk, I recommend setting up KeePassXC as an autostart application, to make sure it runs before your browser.