I have an application where we’re implementing Keycloak for authentication. We’re integrating with an external IdP (Azure) via Oidc.

My realm has 2 clients:

frontend-client: Used by our react app, that stores the the token returned from keycloak/Azure
backend-client: Used by our java app, which accepts the token passed by frontend, and returns a 401 error if the token is not valid.

We’re implementing the logout process, and we’re facing an issue with the backend-client still accepting the token.

When I access https://{my_keycloak_instance}/realms/{realm}/protocol/openid-connect/logout, it successfully logs me out of the front end and I have to reauthenticate, but I can still call my java app via Postman passing the generated token without issue. My expectation was that after logging out, that token would be invalidated.

I have also tried revoking the token at https://{my_keycloak_instance}/realms/{realm}/protocol/openid-connect/revoke, passing frontend-client as the client_id (using backend-client would return an “Unmatching clients” error), but the token can still be used on the backend.

How should I proceed to properly invalidate the token?