Tag

token-exchange

Articles tagged with token-exchange.

security

Keycloak Client Authentication Without Secrets: Signed JWT (private_key_jwt)

Replace Keycloak client secrets with Signed JWT (private_key_jwt): the client signs a short assertion with its own key. Setup, code,…

Guilliano MolaireGuilliano Molaire9 min read
auth-patterns

Keycloak 26.8 Token Exchange Delegation for AI Agents

Keycloak 26.8 moves token exchange delegation to preview: users consent, FGAP V2 gates the agent, and the delegated token carries…

Guilliano MolaireGuilliano Molaire15 min read
security

CVE-2026-97846: Keycloak Token Exchange Drops mTLS Binding

CVE-2026-97846 lets Keycloak standard token exchange issue an unbound Bearer token for an mTLS-bound client. What it breaks, who is…

Guilliano MolaireGuilliano Molaire11 min read
security

CVE-2026-93999: Keycloak Refresh Restores a Disabled Audience

Keycloak checks an audience client is enabled during token exchange, but not when that refresh token is used. What CVE-2026-93999…

Guilliano MolaireGuilliano Molaire8 min read
auth-patterns

Keycloak Token Exchange: Practical Implementation Guide

Implement Keycloak standard token exchange (RFC 8693) in 26.x: enable it per client, set up audiences, and call it from…

Guilliano MolaireGuilliano Molaire10 min read
Keycloak Token Exchange: How It Works (V2 vs V1)
Articles

Keycloak Token Exchange: How It Works (V2 vs V1)

How Keycloak token exchange (RFC 8693) works in 26.x: standard V2 vs legacy V1, request parameters, audience and scope rules,…

Guilliano MolaireGuilliano Molaire14 min read

Stay ahead on identity & security

Get tutorials, product updates, and Keycloak tips delivered to your inbox.

Start Free TrialTalk to Sales
© 2026 Skycloak. All Rights Reserved. Design by Yasser SolimanKeycloak™ is a trademark of the Linux Foundation. Skycloak is not affiliated with the Keycloak project.