OIDC without the headaches: how we got WikiMind working with Keycloak

At WikiMind, we integrated OIDC through Keycloak with PKCE authorization — the foundation for a proper, secure auth scheme in 2026, when “log in with anything” is already a must-have.

Then it got interesting: we added proactive background token validation. That means the system doesn’t wait for a token to expire at the worst possible moment; instead, it checks it ahead of time using configurable validation_threshold and refresh_buffer values.

We also ran into a classic high-load problem: protection against duplicate OIDC validations, so under pressure we wouldn’t end up DDoSing our own provider 😅

And yes, if the OIDC provider is temporarily unavailable, WikiMind doesn’t panic: we keep working with cached tokens. Like a colleague who stepped out for coffee while production is still holding up.

Result: fewer unexpected logouts, a more stable auth flow, and a calmer life for the team.