I have Keycloak working very well now where it can validate users in its own database, against a legacy database in our company, and from Google and Microsoft.   Right now I have been testing with this module for Apache: 

And it works as it should.   I can go to a webpage on my webserver, and the complete flow works well.  The user is redirected to the login page, then it returns, and my webserver requests a token as it should.  :)

What I plan on doing though is securing a mobile App.   I cannot find a raw HTTP(s) example of how to make a direct access grant where keycloak well ask the user for credentials, and directly return an jwt?   Is this possible, or should I use the two step method (keyclock with redirect => to URL in APP => makes request with code to get the tokens?

Also, does anyone have good standalone python, node.js or even C code to validate a token?  I see there are libraries, but I would like to use just openssl if possible.

Thank you,

Reed Lewis