Authorisation code flow

Token acquisition

Option A: WITH Consent Screen (Third-Party Apps)

Option B: WITHOUT Consent Screen (First-Party/Trusted Apps)

Consent Revocation Flow

Token Verification Flow (API Gateway's Role)

Token Refresh Flow

Key Takeaways:

✅ API Gateway IS Involved In:

1. Validating access tokens on every API request

2. Verifying JWT signatures using Keycloak's public keys

3. Checking token expiration and claims

4. Extracting user information from token claims

5. Enforcing rate limits based on user identity

6. Routing requests to appropriate backend services

7. Adding user context headers for backend services

❌ API Gateway IS NOT Involved In:

1. Initial login (authorization code flow)

2. Token generation (Keycloak handles this)

3. Token refresh (direct client-to-Keycloak)

4. Token revocation (direct client-to-Keycloak)

5. User registration (direct to Keycloak or via dedicated service)

6. Password reset (Keycloak handles this)

7. Social login callbacks (Keycloak handles OAuth with providers)

Why This Separation?

1. Security: Keycloak is specialized for identity management - don't duplicate sensitive logic

2. Scalability: Gateway validates stateless JWTs without hitting Keycloak every time

3. Performance: Local JWT validation is much faster than network calls

4. Separation of Concerns: Gateway focuses on API traffic, Keycloak on identity

5. Reduced Coupling: Clients can get tokens even if gateway is down

6. Standards Compliance: Follows OAuth 2.0/OIDC specifications correctly

The API Gateway acts as a stateless validator rather than an authentication provider. It trusts tokens signed by Keycloak and focuses on fast, scalable validation of those tokens.