Everything the tutorials get wrong, wired correctly
JWKS, not pasted keys
Verification keys come from the realm's JWKS endpoint — cached, rate-limited, refreshed on unknown kid. Key rotation becomes a non-event.
Audience validation that works
Keycloak doesn't put your API in aud by default — the shipped realm's audience mapper fixes that, so tokens minted for other clients are rejected.
The issuer split, solved
Tokens carry the URL the client used; your API reaches Keycloak internally. Two env vars (KC_AUTH_SERVER_URL / KC_ISSUER) solve the classic Docker networking 401.
The full middleware family
hasRole, hasAnyRole, hasAllRoles, hasScope, hasResourceRole — simple, composable checks on a verified req.user.
No frontend required
The demo realm enables direct access grants, so curl gets you a token in one command. Swagger on every endpoint. Works with any OIDC client you bring.
Tested, twice
Middleware unit tests (no services needed) plus a smoke e2e proving the full token → validation → role-gating chain against the compose stack in CI.
Pricing
✓ Unlimited projects, commercial included
✓ Unit + e2e tests, CI workflow, full documentation
✓ v1.x updates included
✓ Same realm in both kits — they compose out of the box
✓ Save 15% buying together
Launch pricing — one-time purchase, no subscription.
Paid kits open soon — start with the free tier on GitHub.
What's in the box
The full Express API (middleware, routes, config validation), Dockerfile + compose, PM2 config, the realm export, and a fail-fast env template.
Architecture & request flow, the realm export explained — including importing it into your existing Keycloak — a production checklist, and troubleshooting organized by the 401 you're actually seeing.
Instant zip at checkout; updates ship as new zips — re-download anytime from your purchase library. Plain-language commercial license: unlimited projects, no resale as a template.
Deep dive first? Read the launch article — it walks the exact failure modes this kit exists to prevent.