Tokens, Scopes & Mappers
What this module covers
Section titled “What this module covers”Tokens are the beating heart of every Keycloak-secured system. When a user logs in, Keycloak issues tokens that your applications and APIs use to verify identity and enforce authorisation. Understanding what goes into a token — and why — is essential for building secure, well-designed systems.
This module walks through three tightly related concepts:
- Tokens — the JWTs that carry identity and permissions between parties.
- Scopes — the named bundles that control which claims and permissions end up in a token.
- Mappers — the rules that transform user data into token claims.
Lessons in this module
Section titled “Lessons in this module”| Lesson | What you will learn |
|---|---|
| Token Types | Access tokens, ID tokens, and refresh tokens — and when to use each |
| Client Scopes | Default vs optional scopes, built-in scopes, and how to assign them |
| Protocol Mappers | Adding and transforming claims with mappers |
| Token Lifespans | Configuring access, refresh, and session lifespans |
Learning outcomes
Section titled “Learning outcomes”By the end of this module you will be able to:
- Explain the difference between an access token, an ID token, and a refresh token.
- Describe which token your REST API should validate on every request.
- Create and assign client scopes — both default and optional.
- Add a protocol mapper to include a custom claim in an access token.
- Configure token lifespans at the realm level and override them per client.
- Explain why short access token lifespans improve security.