oauth2
Articles tagged with oauth2.
Access Token vs Refresh Token: Key Differences
Access tokens authorize API calls briefly; refresh tokens only obtain new tokens. How they differ, and what Gitea 28.1.0 fixed…
8 min readID Token vs Access Token: Differences and How to Validate
An ID token tells your app who signed in; an access token tells an API what the caller may do.…
7 min readStateless MCP: What the 2026-07-28 Spec Changes for Tool Builders
MCP went stateless in the 2026-07-28 spec: no initialize handshake, no Mcp-Session-Id. Here is what changes for MCP servers and…
10 min readKeycloak MCP Server 401: Fixing the Audience Claim
MCP clients get a 401 from Keycloak-protected servers because of a wrong aud claim. Here is the RFC 8707 cause,…
5 min read
Keycloak with Spring Boot in Docker, Then Managed
Run Keycloak in Docker with a Spring Boot app, then move the same app to managed Keycloak without changing code.…
9 min readCross-App Access (ID-JAG) for AI Agents, and Where Keycloak Stands
Cross-App Access (ID-JAG) lets your identity provider broker scoped API access for AI agents instead of per-app consent and refresh-token…
6 min read
Python Authentication: Login Pages Without Storing Passwords
Build a Python login page that never stores a password: Flask and Authlib with PKCE, Keycloak as the identity provider,…
8 min readToken Introspection vs Local JWT Validation in Keycloak
Keycloak token introspection vs local JWT validation: how each works, the latency and revocation trade-offs, and which to use for…
10 min readKeycloak Offline Tokens Explained
What Keycloak offline tokens are, how the offline_access scope works, how they differ from regular refresh tokens, and when to…
11 min readKeycloak UMA 2.0: User-Managed Resource Sharing
A practical guide to User-Managed Access (UMA 2.0) in Keycloak: the permission ticket flow, RPT tokens, resource sharing, and when…
11 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.