--- title: Authentication Microservices Using Keycloak, Apache... description: A step-by-step guide to centralizing authentication in a microservices architecture using Keycloak as the Identity Provider, Apache APISIX as the API Gateway,... canonical: https://daily.dev/posts/authentication-microservices-using-keycloak-apache-apisix-and-openid-connect-u6xi0udtu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Authentication Microservices Using Keycloak, Apache APISIX, and OpenID Connect | daily.dev og:description: A step-by-step guide to centralizing authentication in a microservices architecture using Keycloak as the Identity Provider, Apache APISIX as the API Gateway,... og:url: https://daily.dev/posts/authentication-microservices-using-keycloak-apache-apisix-and-openid-connect-u6xi0udtu og:image: https://api.daily.dev/og/posts/u6Xi0UDTU.png og:image:alt: Authentication Microservices Using Keycloak, Apache APISIX, and OpenID Connect og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Authentication Microservices Using Keycloak, Apache APISIX, and OpenID Connect **[Medium](https://daily.dev/sources/medium_js)** · 15 min read · 2 upvotes · 0 comments ## Summary A step-by-step guide to centralizing authentication in a microservices architecture using Keycloak as the Identity Provider, Apache APISIX as the API Gateway, and the OpenID Connect plugin. Covers Keycloak realm setup, custom user attributes and JWT claims, programmatic user creation via the Admin REST API with Redis token caching, and configuring APISIX routes and the OIDC plugin to validate JWTs before forwarding requests. Backend services (written in Go with Echo) consume authenticated user info from the X-Userinfo header injected by APISIX, eliminating duplicated JWT validation logic across services. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I centralize JWT authentication for microservices instead of validating tokens in every service? Move JWT validation to an API gateway using the OpenID Connect plugin, so backend services never need to parse tokens themselves. Apache APISIX validates the access token issued by Keycloak, checks signature, expiration, and issuer, then forwards the decoded claims to the upstream service via a base64-encoded X-Userinfo header for the backend to consume. _See how developers architect gateway-based auth for microservices on daily.dev before wiring up their own stack._ ### How does Apache APISIX pass authenticated user claims to a backend service after validating a JWT? APISIX's OpenID Connect plugin extracts the user's claims from the validated JWT and forwards them to the upstream service in a base64-encoded JSON object inside an X-Userinfo header, containing fields like sub, role, and exp. The backend decodes this header in middleware instead of verifying the original JWT itself. _Developers tuning gateway-to-service auth handoffs can compare approaches like this on daily.dev._ ### Why would I use the client credentials grant instead of a user token when creating users via the Keycloak Admin API? Client credentials is the correct OAuth2 flow because creating a user is a machine-to-machine operation with no end user involved. The backend requests an admin access token using its client ID and secret, then caches that token in Redis with a TTL matching its expiry (typically under an hour) to avoid re-fetching it on every user creation call. _Track patterns like this for machine-to-machine auth flows on daily.dev when designing backend integrations._ ## Similar posts on daily.dev - [Apache Polaris OIDC with Keycloak and Okta](https://daily.dev/posts/apache-polaris-oidc-with-keycloak-and-okta-cjfeyusju) · Dremio Blog · 0 upvotes · 0 comments - [Medium](https://daily.dev/posts/medium-tpgjrsou1) · Medium · 1 upvotes · 0 comments - [Integrate Keycloak with ASP.NET Core Using OAuth 2.0](https://daily.dev/posts/integrate-keycloak-with-asp-net-core-using-oauth-2-0-w348tdawg) · Milan Jovanović · 11 upvotes · 1 comments - [Spring Boot: Handling the OAuth2 Login Flow](https://daily.dev/posts/spring-boot-handling-the-oauth2-login-flow-emzofocay) · iO tech\_hub · 2 upvotes · 0 comments --- Tags: [#infrastructure](https://daily.dev/tags/infrastructure), [#golang](https://daily.dev/tags/golang), [#authentication](https://daily.dev/tags/authentication), [#apache-apisix](https://daily.dev/tags/apache-apisix) [View this post on daily.dev](https://daily.dev/posts/authentication-microservices-using-keycloak-apache-apisix-and-openid-connect-u6xi0udtu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Authentication Microservices Using Keycloak, Apache APISIX, and OpenID Connect","url":"https://daily.dev/posts/authentication-microservices-using-keycloak-apache-apisix-and-openid-connect-u6xi0udtu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/authentication-microservices-using-keycloak-apache-apisix-and-openid-connect-u6xi0udtu"},"datePublished":"2026-08-01T19:37:17.237Z","dateModified":"2026-09-14T08:04:11.544Z","description":"A step-by-step guide to centralizing authentication in a microservices architecture using Keycloak as the Identity Provider, Apache APISIX as the API Gateway,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/64fa96aca8d39ef5d4474b649e2baffc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/64fa96aca8d39ef5d4474b649e2baffc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/authentication-microservices-using-keycloak-apache-apisix-and-openid-connect-u6xi0udtu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"infrastructure,golang,authentication,apache-apisix","timeRequired":"PT15M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"Authentication Microservices Using Keycloak, Apache APISIX, and OpenID Connect"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/authentication-microservices-using-keycloak-apache-apisix-and-openid-connect-u6xi0udtu#faq","mainEntity":[{"@type":"Question","name":"How do I centralize JWT authentication for microservices instead of validating tokens in every service?","acceptedAnswer":{"@type":"Answer","text":"Move JWT validation to an API gateway using the OpenID Connect plugin, so backend services never need to parse tokens themselves. Apache APISIX validates the access token issued by Keycloak, checks signature, expiration, and issuer, then forwards the decoded claims to the upstream service via a base64-encoded X-Userinfo header for the backend to consume. See how developers architect gateway-based auth for microservices on daily.dev before wiring up their own stack."}},{"@type":"Question","name":"How does Apache APISIX pass authenticated user claims to a backend service after validating a JWT?","acceptedAnswer":{"@type":"Answer","text":"APISIX's OpenID Connect plugin extracts the user's claims from the validated JWT and forwards them to the upstream service in a base64-encoded JSON object inside an X-Userinfo header, containing fields like sub, role, and exp. The backend decodes this header in middleware instead of verifying the original JWT itself. Developers tuning gateway-to-service auth handoffs can compare approaches like this on daily.dev."}},{"@type":"Question","name":"Why would I use the client credentials grant instead of a user token when creating users via the Keycloak Admin API?","acceptedAnswer":{"@type":"Answer","text":"Client credentials is the correct OAuth2 flow because creating a user is a machine-to-machine operation with no end user involved. The backend requests an admin access token using its client ID and secret, then caches that token in Redis with a TTL matching its expiry (typically under an hour) to avoid re-fetching it on every user creation call. Track patterns like this for machine-to-machine auth flows on daily.dev when designing backend integrations."}}]} ```