Keycloak Client Types: Public, Confidential, Bearer-Only
How to create an OIDC client in Keycloak and pick the right type — public, confidential, or the deprecated bearer-only — with tested commands and the exact errors each one throws.
Keycloak Protocol Mappers: A Complete Field Guide
Every built-in Keycloak protocol mapper, what it emits, its priority, and where to put it — with measured token sizes and the five ways a mapper fails silently.
Keycloak Audience: Get the aud Claim Right
How Keycloak decides what goes in the aud claim, the two mechanisms that put it there, and the ways it silently comes out empty. Tested on Keycloak 26.8.1.
Keycloak Service Accounts and the Client Credentials Grant
Set up a Keycloak service account for machine-to-machine calls — which roles to grant, why the token comes back with no roles in it, and how to drop the shared secret.