Spring Boot 4 Security Starter — OAuth2 Resource Server, Keycloak & JWT Refresh Rotation

Java 21 + Spring Boot 4.1 security base: Keycloak or local JWT login, refresh rotation with reuse detection, @PreAuthorize, 40 tests.

Getting Spring Security right takes days: resource server config, role mapping from Keycloak, refresh tokens that rotate safely, 401/403 bodies your front-end can read, CORS, tests… This starter ships that done on Spring Boot 4.1, with 40 automated tests.

Two login modes, switched by configuration: validate tokens from Keycloak (realm import included), or issue your own JWTs with username/password and rotating refresh tokens with reuse detection. Keycloak docker-compose included (tests use mocked JWTs).

Companion to the REST/JWT API Starter (https://payhip.com/b/wXQ7a) and the Kafka Event Starter (https://payhip.com/b/mH2oM) — this one is security only.

Built by a Java backend engineer in Mexico City.

Includes:

✅ OAuth2 resource server (JWT), public and protected endpoints

✅ Keycloak mode: realm/client roles → ROLE_*, scopes → SCOPE_*, Keycloak 26 docker-compose with realm import (tests use mocked JWTs)

✅ Local mode: login, RS256 access tokens, refresh rotation, reuse detection (family revoked), logout, revoke-all

✅ Roles → fine-grained permissions from config

✅ @PreAuthorize examples (authority checks and owner-or-admin SpEL)

✅ 401/403 and validation errors as RFC 9457 ProblemDetail

✅ CORS from properties, BCrypt via DelegatingPasswordEncoder, signing keys from config

✅ JPA + Flyway (H2 in tests, PostgreSQL in Compose)

✅ 40 tests (32 Spring Boot/MockMvc + 8 unit), no Docker needed for CI

✅ compose.yaml, Dockerfile, GitHub Actions

✅ EN/ES guides + commercial license