Because of this bug: https://issues.jboss.org/browse/KEYCLOAK-767 I changed the aud to point ot clientid and iss to be the realm name. -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com