# JWT Authorization Grant and Identity Chaining in Keycloak 26.5

DevFeed: [JWT Authorization Grant and Identity Chaining in Keycloak 26.5](<https://devfeed.tech/articles/jwt-authorization-grant-and-identity-chaining-in-keycloak-26-5-31745.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2026/01/jwt-authorization-grant>)

Author: Giuseppe Graziano

Published: 2026-01-23T00:00:00Z

Content type: article

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Internet Engineering Task Force (IETF)](<https://devfeed.tech/topics/ietf.md>)

Tags: [authorization](<https://devfeed.tech/tags/authorization.md>), [deprecated](<https://devfeed.tech/tags/deprecated.md>), [external](<https://devfeed.tech/tags/external.md>), [identity](<https://devfeed.tech/tags/identity.md>), [idm](<https://devfeed.tech/tags/idm.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [oauth-2-0](<https://devfeed.tech/tags/oauth-2-0.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [preview](<https://devfeed.tech/tags/preview.md>), [saml](<https://devfeed.tech/tags/saml.md>), [sso](<https://devfeed.tech/tags/sso.md>), [standard](<https://devfeed.tech/tags/standard.md>), [trust](<https://devfeed.tech/tags/trust.md>)

## AI overview

Keycloak 26.5 introduces preview support for JWT Authorization Grant under RFC 7523. The feature lets clients exchange a signed JWT from an external issuer for a Keycloak access token. The article also explains how combining this grant with OAuth 2.0 Token Exchange can preserve identity and authorization context across multiple trust domains.

## Source excerpt

Modern applications and AI agents increasingly operate across distributed trust domains, where each domain is protected by its own OAuth 2.0 Authorization Server. A single request may also traverse multiple resource servers to complete a task. This raises an important challenge: every protected resource must understand who initiated the request, which authorization was granted, and optionally which other resources were accessed before making an authorization decision. Preserving this information across domains is critical. Keycloak 26.5 introduces preview support for the new feature JWT Authorization Grant, implementing RFC 7523. This feature allows a client to present a signed JWT from an external issuer and obtain a Keycloak access token, providing a standard and secure way to authorize requests based on external assertions. However, exchanging a token alone does not fully solve the problem of propagating identity and authorization context across multiple trust domains. The IETF draft OAuth Identity and Authorization Chaining Across Domains defines a standardized flow that combines JWT Authorization Grant (RFC 7523) with OAuth 2.0 Token Exchange (RFC 8693), which Keycloak already supports, to preserve the original user's identity, claims, and authorization throughout the chain. JWT Authorization Grant The JWT Authorization Grant feature allows a client to present a signed JWT assertion to the token endpoint and obtain an access token without an interactive authorization step. To initiate this flow, the client sends a request to the token endpoint with the grant_type set to urn:ietf:params:oauth:grant-type:jwt-bearer and the external token passed in the assertion parameter. It provides a standard and secure alternative to the preview feature External-to-Internal Token Exchange V1 which will be deprecated. Trust relationships in Keycloak are defined through Identity Providers. The JWT Authorization Grant can be enabled and configured in a dedicated section of the ex