# Bound Access Tokens : is it also mandatory to add X.509 client certificate authentication to browser flows?

**URL:** <https://forum.keycloak.org/t/bound-access-tokens-is-it-also-mandatory-to-add-x-509-client-certificate-authentication-to-browser-flows/12968>\
**Category:** Configuring the server\
**Tags:** authentication, oidc\
**Created:** [January 10, 2022, 7:09pm UTC](https://forum.keycloak.org/t/bound-access-tokens-is-it-also-mandatory-to-add-x-509-client-certificate-authentication-to-browser-flows/12968 "2022-01-10T19:09:06Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![semangard](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/semangard/32/1922_2.png) [@semangard](https://forum.keycloak.org/u/semangard)\
**Post date:** [January 10, 2022, 7:09pm UTC](https://forum.keycloak.org/t/bound-access-tokens-is-it-also-mandatory-to-add-x-509-client-certificate-authentication-to-browser-flows/12968/1 "2022-01-10T19:09:06Z")

</div>

Hello,

I would like to use [Bound Access Tokens](https://www.keycloak.org/docs/latest/server_admin/#_mtls-client-certificate-bound-tokens)  
but i would like to know if I also need to add [X.509 client certificate authentication to browser flows](https://www.keycloak.org/docs/latest/server_admin/#enable-x-509-client-certificate-user-authentication) ?

In other words, does it work only when a client is authenticated **by KeyCloak** thanks to a X.509 client certificate ?

The underlying question is : is the token bound to a device certificate or a user certificate ?

Regards