django-keycloak-auth
Reusable auth package, published internally · 2026
What it is
A Django package that implements Keycloak authentication on the Backend-for-Frontend pattern. I am the largest contributor, with 50 of its 105 commits, and wrote the auth, config, IAM service and view layers. It is the auth layer Tasq runs on.
Things worth pointing out
Tokens never reach the browser
The authorization code exchange happens entirely server-side. The frontend gets a short-lived, single-use code, redeems it for tokens, and refreshes through a backend proxy, so the client secret and the refresh flow stay on the server.
JWT validation
Access tokens are validated on every request against the realm's JWKS endpoint, with the public keys cached. First successful login links or creates the Django user and stores the Keycloak id.
Shipped like a real package
Versioned, typed with a py.typed marker, and published to an internal PyPI index by a tag-triggered GitLab CI pipeline.