Definition and Basics
Articles about definition and basics from the Skycloak team.
ID Token vs Access Token: Differences and How to Validate
An ID token tells your app who signed in; an access token tells an API what the caller may do.…
7 min readThe Joiner-Mover-Leaver (JML) Process for SaaS Teams
The joiner-mover-leaver (JML) process explained: what each stage means, why movers and leavers cause audit findings, and how SaaS teams…
8 min readWhat Is Identity Brokering? One Login Box for Social and Enterprise IdPs
Identity brokering lets one identity provider sign users in through Google, Okta or Entra and issue its own token. Learn…
7 min readIAM vs IGA: What Identity Governance and Administration Adds for Growing SaaS Teams
IAM decides who can sign in; IGA shows who should have access, who approved it and that it was removed.…
11 min readWhat Is an Identity Provider? IdP and SSO Examples
What is an identity provider? Learn what SSO IdP means, follow a sign-in through SAML and OIDC, and compare workforce…
9 min readWhat Is IDaaS? Identity as a Service Explained
IDaaS (identity as a service) means a vendor runs your login, MFA, SSO and tokens in the cloud. See what…
6 min readIssuing Verifiable Credentials With Keycloak (OID4VCI)
How to issue Verifiable Credentials from Keycloak with OID4VCI: what the standard is, Keycloak's experimental support, and how it fits…
12 min readNon-Human Identity (NHI) for AI Agents on Keycloak
A non-human identity is an identity used by software, not a person. How AI agents fit, why one shared bot…
10 min readKeycloak MCP Server 401: Fixing the Audience Claim
MCP clients get a 401 from Keycloak-protected servers because of a wrong aud claim. Here is the RFC 8707 cause,…
5 min readCross-App Access (ID-JAG) for AI Agents, and Where Keycloak Stands
Cross-App Access (ID-JAG) lets your identity provider broker scoped API access for AI agents instead of per-app consent and refresh-token…
6 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.