Project Lightning Talk: How to get your custom access tokens from Keycloak
summary
Keycloak issues access tokens as JSON Web Tokens (JWTs) containing configurable claims like expiry, issuer, email_verified and username and you can map claims to scopes, set defaults or optional, and choose which token types carry each claim. Authentication code flow serves users, client credentials serve services, and token exchange is now standard‑compliant so the token endpoint swaps tokens to the right audience and scopes. Admin UIs and custom mappers exist to build the exact token shape needed.
AI-written summary · about
related talks
29mThe Keycloak-Token-Configuration Mistake, 90% of All Developers Do (and How To Avoid It)
32mTips and Tricks for JSON Web Tokens (JWTs)
24mA Token Walks Into a SPA
14mAPI access control strategies beyond JWT bearer tokens
25mHow JSON Web Tokens Work and Can be Used to Secure Your Single Page Apps
29mKnock knock, who's there? Authenticating your single page apps using JSON Web Token
48mAdding business logic to your tokens. What could possibly go wrong
32mPortable Sessions with JSON Web Tokens