Insights on Identity, Security & Keycloak
Tutorials, deep dives, and best practices from the Skycloak team.
Authentication Methods Explained: What Keycloak Supports
Authentication methods prove who a user is with something they know, have or are. See the main types, and which…
14 min read
What Is PKCE? Proof Key for Code Exchange Explained
PKCE protects the OAuth 2.0 authorization code flow from stolen codes. Follow one S256 exchange with real values, and learn…
12 min read
Keycloak 26.8.2 Admin API Returns 401 for Service Accounts: The kc-admin-api Scope Fix
After upgrading to Keycloak 26.8.2, service account tokens get 401 from the Admin REST API. Why the new audience check…
7 min read
How to change the username label on the Keycloak login page
To change the username label on the Keycloak login page, add a realm override for usernameOrEmail, username or email in…
4 min readSecuring Hasura GraphQL with Keycloak JWT Claims
Secure Hasura GraphQL with Keycloak: configure JWT mode, add the x-hasura-* custom claims via a protocol mapper, and map Keycloak…
10 min read
What Is a Rainbow Table Attack and How Salting Stops It
A rainbow table is a precomputed table of hash chains that reverses unsalted password hashes fast. Here is how it…
12 min read
What Is a Passkey? How Passkeys Replace Passwords
A passkey is a FIDO2/WebAuthn sign-in credential: your device keeps a private key unlocked by face, fingerprint or PIN, and…
12 min read
Ivanti Connect Secure CVE-2026-111357 Exploited: What to Do
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to the KEV catalog on 30 October 2026. Upgrade, reset, rotate and…
13 min readJWT Vulnerabilities: Algorithm Confusion, None Alg and Safe Validation
Most JWT vulnerabilities come from trusting the header. See each attack, from alg none to algorithm confusion and kid injection,…
19 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.