[Resending this because apparently I wasn't subscribed to this mailing list before!] ---- Hey guys. This is in reference to the discussion here: https://issues.jboss.org/browse/KEYCLOAK-1472 At Bill's request, I'm moving it here. I think KEYCLOAK-1472 (for us) might have a couple different aspects to it. So I'm going to focus on just one in this email. And I'll start a different thread for the other aspect. We have a REST endpoint located at /apiman which is protected by keycloak. We need to support both bearer token authentication *and* BASIC authentication on that endpoint. Our apiman UI uses bearer-token auth to access the API. However, for scripts and CLIs and other integrations, we need to allow users to provide BASIC auth credentials if they so choose. In any case, here is the relevant config in standalone.xml for this: <kc:secure-deployment xmlns:kc="urn:jboss:domain:keycloak:1.0" name="apiman.war"> <kc:realm>apiman</kc:realm> <kc:resource>apiman</kc:resource> <kc:credential name="secret"> password </kc:credential> <kc:enable-basic-auth>true</kc:enable-basic-auth> <kc:disable-trust-manager>true</kc:disable-trust-manager> </kc:secure-deployment> This works great unless authentication fails, at which point we get a redirect to the login page. That makes sense if this were a UI, but it's not. The solution to the redirect problem is to add: <kc:bearer-only>true</kc:bearer-only> This fixes the redirect to login page problem but it disables BASIC auth support. Can we get an option that disables the login redirect but still allows BASIC auth to work? -Eric