# PKCE with Keycloak and Passport

DevFeed: [PKCE with Keycloak and Passport](<https://devfeed.tech/articles/pkce-with-keycloak-and-passport-25137.md>)

Original publisher: [Read original article](<https://blog.brakmic.com/pkce-with-keycloak-and-passport/>)

Author: brakmic

Published: 2025-01-20T12:09:12Z

Content type: tutorial

Language: en

Sources: [Harris Brakmic - Coding](<https://devfeed.tech/sources/harris-brakmic-coding.md>)

Topics: [pkce](<https://devfeed.tech/topics/pkce.md>), [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Security](<https://devfeed.tech/topics/security.md>), [Docker](<https://devfeed.tech/topics/docker.md>), [Docker Compose](<https://devfeed.tech/topics/docker-compose.md>), [Single-page application (SPA)](<https://devfeed.tech/topics/spa.md>), [Testing](<https://devfeed.tech/topics/testing.md>), [TypeScript](<https://devfeed.tech/topics/typescript.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [coding](<https://devfeed.tech/tags/coding.md>), [docker](<https://devfeed.tech/tags/docker.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [oauth2](<https://devfeed.tech/tags/oauth2.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [pkce](<https://devfeed.tech/tags/pkce.md>), [security](<https://devfeed.tech/tags/security.md>), [testing](<https://devfeed.tech/tags/testing.md>), [typescript](<https://devfeed.tech/tags/typescript.md>)

## AI overview

A practical guide to using passport-keycloak-oauth2-oidc-portable with Keycloak, OAuth2, and OpenID Connect. It covers switching the library to TypeScript, adding integration and end-to-end tests, running a local Keycloak instance with Docker Compose, and implementing PKCE for public clients such as single-page applications.

## Source excerpt

Discover how passport-keycloak-oauth2-oidc-portable integrates Keycloak with OAuth2 and OpenID Connect (OIDC) using the secure Proof Key for Code Exchange (PKCE) protocol. This article explores implementing PKCE to protect public clients like desktop and single-page applications from common authentication vulnerabilities such as CSRF and authorization code interception. Learn about setting up a Keycloak test instance with Docker to facilitate seamless local development and testing. Through a practical example, see how PKCE aligns with modern security standards, providing a robust and efficient authentication mechanism for your applications. Whether you're enhancing existing authentication flows or building new solutions, this guide offers valuable insights into leveraging PKCE, Keycloak, and Passport.js to create secure authentication frameworks.