Keycloak Is Not Your Zero Trust Architecture
Where Keycloak's job ends and your APIs' job begins: two Go APIs, eleven requests that should succeed or fail, and the results from a real run.
#oauth2
Keycloak Token Exchange, Hands-On
How standard token exchange (RFC 8693) works in Keycloak 26, why the audience is everything, and a Docker lab that shows the main success and failure cases on the wire.