# Generating a token through the token endpoint is slow (about 200 ms in average). Is it normal?

**URL:** <https://forum.keycloak.org/t/generating-a-token-through-the-token-endpoint-is-slow-about-200-ms-in-average-is-it-normal/12204>\
**Category:** Getting advice\
**Tags:** authentication\
**Created:** [November 19, 2021, 9:40am UTC](https://forum.keycloak.org/t/generating-a-token-through-the-token-endpoint-is-slow-about-200-ms-in-average-is-it-normal/12204 "2021-11-19T09:40:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![omasseau](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/omasseau/32/4433_2.png) [@omasseau](https://forum.keycloak.org/u/omasseau)\
**Post date:** [November 19, 2021, 9:40am UTC](https://forum.keycloak.org/t/generating-a-token-through-the-token-endpoint-is-slow-about-200-ms-in-average-is-it-normal/12204/1 "2021-11-19T09:40:09Z")

</div>

Hello,

I noticed that generating a token through the token endpoint (ex: [http://localhost:8080/auth/realms/test/protocol/openid-connect/token](http://localhost:8080/auth/realms/test/protocol/openid-connect/token)) takes about 200 ms.

Is is normal that it is so slow ? 200 ms seems quite big.  
I’ve just created a test realm and a test client, leaving everything on the default values.

---

<div class="post-metadata">

**Author:** ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)\
**Post date:** [November 19, 2021, 10:06am UTC](https://forum.keycloak.org/t/generating-a-token-through-the-token-endpoint-is-slow-about-200-ms-in-average-is-it-normal/12204/2 "2021-11-19T10:06:52Z")

</div>

It is normal. Especially, first time when data (e.g. roles) are not cached:

 ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/2/2127c5dfeef03880f080d8ab44bfc5f9c00bba1d.png)

But subsequent calls are usually faster, because cache:

 ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/b/bd212052b4c6fd7fd67d64fe7484015039b51495.png)

Tracing will help you to undestand more the perf issues - example [GitHub - jangaraj/keycloak-with-opentelemetry](https://github.com/jangaraj/keycloak-with-opentelemetry)

---

<div class="post-metadata">

**Author:** ![omasseau](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/omasseau/32/4433_2.png) [@omasseau](https://forum.keycloak.org/u/omasseau)\
**Post date:** [November 20, 2021, 12:32pm UTC](https://forum.keycloak.org/t/generating-a-token-through-the-token-endpoint-is-slow-about-200-ms-in-average-is-it-normal/12204/3 "2021-11-20T12:32:42Z")

</div>

Hum well that’s pretty weird because for me the first time it takes about 600 ms, then all subsequent calls takes 180 ms minimum (200 ms on average):

 ![keycloak](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/9/99c0db6ed5df2c8a3bc882c439a8bb7528e63d56.png)

I’m using Keycloak 15.0.1.  
Just after creating the realm I created the user and that’s all. So I have a single user and no roles defined.

---

<div class="post-metadata">

**Author:** ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)\
**Post date:** [November 20, 2021, 2:20pm UTC](https://forum.keycloak.org/t/generating-a-token-through-the-token-endpoint-is-slow-about-200-ms-in-average-is-it-normal/12204/4 "2021-11-20T14:20:45Z")

</div>

As I said - yes token endpoint is slow. Your slowness is 600ms. That’s nothing. I have had 5s+ (full scope, roles from LDAP, 1k+ clients), so some service providers (hi AWS ALB with OIDC) was failing.

“So I have a single user and no roles defined.” Yeah, but by default you have mappers/scope which still try to find roles, so there are still SQL executed, which are trying to get roles.

If you are asking how to improve token performance, then search forum [Search results for 'slow token' - Keycloak](http://forum.keycloak.org/search?q=slow%20token) it was already discussed - disable full scope, remove all uneccesary roles, scopes, mappers, … Default Keycloak settings are trying to cover the most user cases and they are not focused on the best token endpoint performance.

---

<div class="post-metadata">

**Author:** ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)\
**Post date:** [November 24, 2021, 7:32am UTC](https://forum.keycloak.org/t/generating-a-token-through-the-token-endpoint-is-slow-about-200-ms-in-average-is-it-normal/12204/5 "2021-11-24T07:32:52Z")

</div>

Real world numbers

Setup: Vanilla Keycloak 15.0.2, OIDC client with default settings vs minimal settings  
avg 234ms vs 165ms for remote token enpoint response time (tested with Direct Access Grant flow) - 30% better performance with minimal settings.

 ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/9/99133caa13ae375ec080ff2e7be7045df56701b0.png)