oauth2
Articles tagged with oauth2.
What Is PKCE? Proof Key for Code Exchange Explained
PKCE protects the OAuth 2.0 authorization code flow from stolen codes. Follow one S256 exchange with real values, and learn…
12 min readKeycloak Client Authentication Without Secrets: Signed JWT (private_key_jwt)
Replace Keycloak client secrets with Signed JWT (private_key_jwt): the client signs a short assertion with its own key. Setup, code,…
9 min readWhat Is a Bearer Token? How Bearer Authentication Works
A bearer token grants access to whoever holds it. How to send it in the Authorization header, opaque vs JWT…
16 min readWhat Is a JWT Token? Structure, Claims and Signatures
A JWT token is a signed Base64URL string with a header, payload and signature. What each part holds, which claims…
12 min readWhat Is a Nonce in Security? Nonce vs State vs PKCE
A nonce is a number used once, a unique value that stops replay. Learn how nonces are generated and how…
14 min readAccess Token vs Refresh Token: Key Differences
Access tokens authorize API calls briefly; refresh tokens only obtain new tokens. How they differ, and what Gitea 28.1.0 fixed…
8 min readID Token vs Access Token: Differences and How to Validate
An ID token tells your app who signed in; an access token tells an API what the caller may do.…
7 min readStateless MCP: What the 2026-07-28 Spec Changes for Tool Builders
MCP went stateless in the 2026-07-28 spec: no initialize handshake, no Mcp-Session-Id. Here is what changes for MCP servers and…
10 min readKeycloak MCP Server 401: Fixing the Audience Claim
MCP clients get a 401 from Keycloak-protected servers because of a wrong aud claim. Here is the RFC 8707 cause,…
5 min read
Keycloak with Spring Boot in Docker, Then Managed
Run Keycloak in Docker with a Spring Boot app, then move the same app to managed Keycloak without changing code.…
9 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.