> For the complete documentation index, see [llms.txt](https://docs.tpi.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tpi.dev/most-common-use-cases/oidc-integration-obtaining-tokens-from-keycloak-and-calling-apis-via-digirunner/configuring-keycloak-client-with-pkce-and-registering-a-user.md).
# Configuring Keycloak Client with PKCE and Registering a User
This section explains how to integrate digiRunner with Keycloak to establish a standard API access authentication and authorization mechanism. This enhances system security and simplifies identity management workflows.
#### Creating Client in Keycloak
1. Log in to the Keycloak admin console, and select **Clients** from the left **sidebar** to access the client management page, which lists all existing clients.
2. Click **Create Client** in the upper right corner to access the client creation page, and configure the client as follows:
* **Client Type**: Select **OpenID Connect** from the drop-down menu.
* **Client ID**: Enter a unique identifier for this client. This value will be used later in integration settings.
* **Name**:Enter a meaningful name to easily identify the client’s purpose.
* **Description**: O*ptional.* Add a brief description for reference and future maintenance.
3\. Click the Capability config tab to proceed.
#### Configuring Client Capabilities
1. On the **Capability config** page, ensure that **Client authentication** is **On (enabled)**, indicating this is a **confidential client**.
2. In the **Authentication flow** section:
* **Check Standard flow to enable the standard Authorization Code Flow for this client.**
* Uncheck **Direct access grants** to disable the **Resource Owner Password Credentials Flow**.
3. Click the **Login settings** tab to proceed.
#### Configuring Login Settings
1. In the **Valid redirect URIs** field, enter: [`https://oauth.pstmn.io/v1/callback`](https://oauth.pstmn.io/v1/callback).\
This is the default callback URL for Postman and is required when testing the OAuth flow using Postman.
2. Click **Save** to complete the client creation.
#### Enabling PKCE with S256 Hash Algorithm
This section guides you through enabling PKCE using the secure S256 hashing algorithm, ensuring the client and authorization server use the same method.
1. Once the client is created, switch to the **Clients** list tab and click the newly created client to access the setting page.
2. Go to the **Advanced** tab, and select **Advanced settings from the** right panel to jump to that section.
3. In the **Proof Key for Code Exchange Code Challenge Method** field, select **S256** to enable PKCE.
#### Retrieving the Client Secret
1. Click the **Credentials** tab to access the page.
2. Locate the **Client Secret** field, and click on the  icon to reveal the secret.
3. Copy this value. It will be required when configuring the **IdP Client Secret** in digiRunner’s OAuth 2.0 settings.
#### Creating a Test User Account
1. In the left sidebar, go to **Users** and click **Add user** to create a new user.
2. Enter a **Username** for the account and click **Create**.
#### Setting up a User Password
1. Once the user is created, go to the **Credentials** tab and click **Set password to proceed**.
2. Enter the **Password** and **Password confirmation** fields.
3. Set **Temporary** to **Off** so the password does not expire upon first login, and click Save.
4. A confirmation dialog will appear. Click **Save password** to confirm.
You have now successfully set up a client with PKCE enabled and created a test user account. You are ready to test the OAuth 2.0 Authorization Code Flow using Postman or connect the setup to digiRunner.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.tpi.dev/most-common-use-cases/oidc-integration-obtaining-tokens-from-keycloak-and-calling-apis-via-digirunner/configuring-keycloak-client-with-pkce-and-registering-a-user.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.