Hi all, I can't remember if I've said this before but it looks like Mojolicious::Plugin::OAuth2 only uses the client_secret_post client authentication method. In the OpenID Connect spec, "client_secret_basic" is actually the default method: https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication I think that Keycloak checks both the Authorization header and the request body, which is probably why it's worked so easily with the Koha OpenID Connect auth. I couldn't find any documentation on this for Keycloak, but I think it's a safe assumption. Reported the issue on Github: https://github.com/marcusramberg/Mojolicious-Plugin-OAuth2/issues/72. Really it should be a very straight forward change to implement in the plugin. David Cook Senior Software Engineer Prosentient Systems Suite 7.03 6a Glen St Milsons Point NSW 2061 Australia Office: 02 9212 0899 Online: 02 8005 0595