Here is what I want to do: I have built REST services in Spring Boot. For the services themselves, I want to use "bearer-only" access type so that applications are NOT redirected to a login page if unauthenticated. However, I want the generated swagger documentation to use the "confidential" access type so that swagger-ui.html redirects the user/browser to a login page and capture the token that will then be passed to the services when testing things out. It seems like the best way to accomplish this is with two clients similar to the demo here: http://blog.keycloak.org/2015/10/getting-started-with- keycloak-securing.html My concern is that having two client configurations in my spring boot application.yml doesn't seem possible - am I missing something? I am aware of the multi-tenant options for Keycloak, but I don't actually want two different realms: https://keycloak.gitbooks.io/documentation/securing_apps/ topics/oidc/java/multi-tenancy.html For whatever configuration I come up with, I want the user's token to apply to both the swagger-ui and the services, but with two different access types. Here are some things I've learned so far: I'm aware that swagger-ui offers an option to authenticate it's services with a token. There are two limitations of this approach: 1. With springfox generated swagger, it doesn't seem to work. I'd have to put a lot of effort to fix this, and I'd rather not because 2. You would still need to get a token from somewhere, and that means pointing users to another login page that isn't automatically prompted when you go to swagger-ui. It just seems like a more annoying user experience to have to take extra steps to generate a token and then paste that into swagger-ui. I'm also aware that my spring boot configuration can be more restrictive than the keycloak client configuration. In other words, I can restrict to bearer-only in my service even if the client is configured for confidential access type. If there is a way for different values for keycloak.bearer-only based on URL pattern in the keycloak-spring-boot-adapter, this could be a real option. Thanks for any help/advice you may have. Jonathan _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user