I using SpringBoot 2.0.5 and keycloak 4.5.0.Final so it's possible to secure an URL using: @PreAuthorize("hasRole('USER')") @GetMapping("/mensagem/enviada/t") instead the .antMatchers("/mensagem/enviada/**").hasRole("USER")