# Looking for advice on Keycloak token storage strategy

**URL:** <https://forum.keycloak.org/t/looking-for-advice-on-keycloak-token-storage-strategy/31337>\
**Category:** Getting advice\
**Created:** [April 21, 2026, 9:50am UTC](https://forum.keycloak.org/t/looking-for-advice-on-keycloak-token-storage-strategy/31337 "2026-04-21T09:50:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nickp](https://avatars.discourse-cdn.com/v4/letter/n/e79b87/32.png) [@nickp](https://forum.keycloak.org/u/nickp)\
**Post date:** [April 21, 2026, 9:50am UTC](https://forum.keycloak.org/t/looking-for-advice-on-keycloak-token-storage-strategy/31337/1 "2026-04-21T09:50:44Z")

</div>

Hello everyone,

I’m trying to figure out the right token handling approach for **Keycloak + Next.js + FastAPI**.

This is **not a pure SPA** , and in the main flow, requests to FastAPI are **mostly made server-side**.

Because of that, I’m trying to understand whether a **server-side / BFF-style token handling** approach is the more natural fit.

I chose Keycloak because I need an **on-prem** solution and flexible **Group / Role** modeling. My use case requires a hierarchy like **Organization \> Team \> User** , and I’m currently thinking of modeling both **Organizations and Teams as Keycloak Groups** , then using **Team roles** for FastAPI authorization.

I also want MFA to be opt-in per Organization, likely using an Organization-level role or attribute to branch the authentication flow.

My main questions are:

- Is server-side token handling the more natural approach in this kind of architecture?

- If so, would you use **Redis or PostgreSQL** for token storage or related session data?

- How would you handle token refresh in a setup like this?

Would appreciate any advice from anyone who has built something similar.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/free1/uploads/keycloak/original/1X/eb342909d95cf32cbb7517610022c6a0046a9ffb.png) [@system](https://forum.keycloak.org/u/system)\
**Post date:** [October 18, 2026, 9:51am UTC](https://forum.keycloak.org/t/looking-for-advice-on-keycloak-token-storage-strategy/31337/2 "2026-10-18T09:51:22Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.