Keycloak Crash Course

OAuth 2.0, OpenID Connect, and JWTs in about an hour — run Keycloak locally, build a realm and client by hand, decode a real access token, and protect a NestJS API with it.

ជំពូកនេះមិនទាន់ត្រូវបានបកប្រែជាភាសាខ្មែរនៅឡើយទេ — សូមអានជាភាសាអង់គ្លេសខាងក្រោម។

Keycloak is an open-source Identity and Access Management (IAM) system — it owns login, password storage, and token issuing so your apps don't have to reinvent them. This series is a self-contained crash course: what Keycloak is, how to run it locally in Docker, how OAuth 2.0 and OpenID Connect fit together, and how to protect a real NestJS API with the tokens Keycloak issues.

By the end you'll have a working Keycloak realm with a client and two test users, and a NestJS API with a public route, a token-protected route, and a role-protected route — validating real Keycloak-issued JWTs.

This series covers the ground needed for one protected API, not everything Keycloak can do — see the final chapter for what's deliberately left out. See the source repository for the runnable reference app.

  1. 01IntroductionWhat Keycloak is, why not just build auth yourself, and where an identity provider fits in a modern application.
  2. 02Keycloak Core ConceptsRealms, users, clients, client types, roles, groups, and the three tokens Keycloak issues — the vocabulary every Admin Console screen is built on.
  3. 03Running Keycloak LocallyRun Keycloak in dev mode via Docker, tour the Admin Console, and create your first realm.
  4. 04Creating a User & ClientCreate realm roles, two test users, and a public OIDC client — the exact realm state every later chapter builds on.
  5. 05OAuth 2.0 / OpenID Connect FlowThe Authorization Code flow step by step, why the app never sees the password, token expiration, and when to reach for Client Credentials instead.
  6. 06Understanding the JWTGet a real Keycloak access token, decode its three segments, and learn the claims a backend actually checks.
  7. 07Protecting a Backend APIBuild a NestJS API with a public route, a JWT-validated route, and a role-protected route against real Keycloak tokens.
  8. 08Wrap UpThe final architecture, a recap table of every term covered, and what this crash course deliberately left out.