Register a Confidential OIDC Client
A 6-step recipe with Keycloak. We can help you get access.
Recipe · 6 steps
Register a Confidential OIDC Client
with Keycloak · Cybersecurity Management
Create a confidential OIDC client and retrieve its client secret.
- Confirm the realm exists and is enabled before registering anything into it.
- Filter the realm's clients by clientId to see whether this application is already registered, keeping the workflow idempotent.
- Register the client as confidential with the authorization code flow on and the implicit flow off. Keycloak generates the secret server-side and answers 201 with a Location header and no body, so the secret is fetched later rather than read
- Exchange the clientId for Keycloak's internal client UUID. Both the created and the already-registered branch converge here, because the secret and detail endpoints are keyed on the UUID rather than the clientId.
- Read the stored client representation back to confirm the flags Keycloak actually persisted, which is the only way to catch a silently defaulted setting.
- Retrieve the server-generated client secret. This is the credential the application needs to complete the authorization code exchange, and it is only ever available from this endpoint.
What you'll need to have ready
- realm: The name of the realm to register the client in.
- clientId: The OAuth client identifier used in OIDC flows (e.g. "billing-web").
- clientName: A human readable display name for the client.
- description: A description of what the client is for.
- rootUrl: The root URL of the application.
- redirectUris: The list of valid redirect URIs for the authorization code flow.
- webOrigins: The list of allowed CORS origins for the client.
- serviceAccountsEnabled: When true the client also gets a service account for the client credentials grant.
For your developer
Arazzo workflow keycloak:register-oidc-client, 6 operations: getRealm → getClients → createClient → getClients → getClient → getClientSecret. Specs on APIs.io.