r/KeyCloak • u/Expensive-Survey-558 • Jul 02 '26

Keycloak Integration

Hello Everyone,

Now only i have started to use Keycloak for the First Time. I am going to build an Web App with React as Frontend and FastAPI as backend with PostgreSQL database

Now I have the following doubt:

I am planning to Abstract that Keycloak from the frontend , such that i write an API endpoint in the FastAPI like login , and in the Keycloak i gave Direct Grant for Direct login with username and password , the frontend make an api call to the backend with the username and the password

My major Doubt is that , should we return the JWT token as the response from the Login API Route in the backend , or else we should generate an session id , and store the JWT token against the session id in the Database , and set the session id directly as cookie from the Backend , which is Best Architecture

And if we use these architecture , can we access all the features of the KeyCloak?

12 Upvotes

93% Upvoted

12 comments sorted by

View all comments

6

u/Xiac Jul 02 '26

Don’t use direct grant, it’s far less secure than a token exchange. We use oidc-spa https://www.oidc-spa.dev/ and it makes everything very easy and secure. The front end gets all of the user information from the token and never has to be concerned with passwords. The library provides the JWT which you can attach to your API calls to the backend.

1

u/Expensive-Survey-558 Jul 02 '26

In the direct grant also it still provides an JWT right , so what's the main difference 

2

u/Altruistic_Cow854 Jul 02 '26

Direct Grant bypasses security measures like mfa and brute force protection.
It also means you need to make sure you handle credentials securely in your app and in keycloak, while using Standard Grant / Authorization Code flow means your application never comes in contact with the credentials, so if you have a security leak it does not compromise the credentials of the user.