Make Every Token Smarter
Enhance the standard Keycloak access token structure with dynamic attributes—organization, roles, clearance, risk signals, or even delegated permissions. And expose them securely in introspection responses.
Enrich Token Payloads and Introspection Responses with Business Context
Why It Matters
Most applications rely on token content and introspection results for authorization decisions. However, default Keycloak tokens may lack the depth and business context required by modern IAM setups.
Keymate's Custom Token Introspector SPI enables:
- Fine-grained enrichment of access tokens at issuance
- Control over what's exposed during OAuth2 introspection
- Dynamic token shaping based on session notes, external attributes, or runtime signals
Tokens That Reflect Reality
This extension allows you to inject real-time, scoped information into tokens, such as:
Token Enrichment and Introspection
Introspection endpoints also reflect this context securely, filtered by client and scope.
Example: Dynamically inject business context into tokens and introspection responses.
Key Components:
Extension Highlights — What Makes It Unique
Access Token Enrichment
Inject runtime metadata into token claims at issuance
Introspection Response Control
Customize what gets exposed in token/introspect
Session Notes Integration
Dynamically read values stored during authentication
Organization & Delegation Aware
Supports enriched fields like org-unit, temporary role, delegation initiator
Token Scoping by Audience
Include or omit fields based on client scopes or audiences
Secure & Audit-Ready
Full traceability via OpenTelemetry and audit logs