Everything the tutorials get wrong, wired correctly
The correct SPA bootstrap
provideKeycloak init with check-sso + PKCE S256 — public pages stay public, sessions adopt silently, no redirect loops.
The 401 refresh queue
Ten concurrent 401s trigger one token refresh, not ten. Parked requests replay with the new token. The interceptor everyone needs and nobody ships.
Silent SSO, actually working
silent-check-sso.html wired and shipped, session-check iframe correctly disabled — third-party-cookie blocking breaks it; this kit doesn't pretend otherwise.
Role guards as route data
createAuthGuard with roles declared per route, a /forbidden page, and a full lazy-loaded shell.
The realm to match
A working realm export auto-imported on first boot — including the audience mapper that makes API-side aud validation possible. Docs cover your existing Keycloak too.
Proven on every push
A scripted end-to-end PKCE login (scripts/e2e-smoke.sh) runs against the compose stack in CI — the product promise, tested continuously.
Pricing
✓ Unlimited projects, commercial included
✓ e2e + CI workflow, full documentation
✓ v1.x updates included
✓ Same realm in both kits — they compose out of the box
✓ Save 15% buying together
Launch pricing — one-time purchase, no subscription.
Paid kits open soon — start with the free tier on GitHub.
What's in the box
The full Angular app (init, interceptor, guards, shell), Dockerfile + compose, the realm export, four build configurations (dev / docker / uat / production).
Architecture & request flow, auth flows (init / refresh queue / silent SSO), the realm export explained — including using your existing Keycloak — a production checklist, troubleshooting by symptom.
Instant zip at checkout; updates ship as new zips — re-download anytime from your purchase library. Plain-language commercial license: unlimited projects, no resale as a template.
Deep dive first? Read the launch article — it walks the exact failure modes this kit exists to prevent.