# Webview in mobile with access token

**URL:** <https://forum.keycloak.org/t/webview-in-mobile-with-access-token/29718>\
**Category:** Getting advice\
**Tags:** authentication, oidc\
**Created:** [March 9, 2025, 2:37pm UTC](https://forum.keycloak.org/t/webview-in-mobile-with-access-token/29718 "2025-03-09T14:37:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![SKDragon18](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/skdragon18/32/11939_2.png) [@SKDragon18](https://forum.keycloak.org/u/SKDragon18)\
**Post date:** [March 9, 2025, 2:37pm UTC](https://forum.keycloak.org/t/webview-in-mobile-with-access-token/29718/1 "2025-03-09T14:37:57Z")

</div>

Hello everyone, i want to know how to imbed access token to webview to authen through apisix and keycloak. Please help me if you know.  
Regardless of the method you have tried:

1. Cookie
2. Header Authorization
3. Param Encode in URL.

This is my setting in apisix:

```auto
{
  "uri": "/service",
  "name": "Service",
  "plugins": {
    "authz-keycloak": {
      "_meta": {
        "disable": false
      },
      "access_token_expires_in": 300,
      "access_token_expires_leeway": 0,
      "cache_ttl_seconds": 60,
      "client_id": "object_removal",
      "client_secret": "ruo5IxxF0v",
      "grant_type": "urn:ietf:params:oauth:grant-type:uma-ticket",
      "http_method_as_scope": false,
      "keepalive": true,
      "keepalive_pool": 5,
      "keepalive_timeout": 60000,
      "lazy_load_paths": false,
      "permissions": [
        "Removal"
      ],
      "policy_enforcement_mode": "ENFORCING",
      "refresh_token_expires_in": 3600,
      "refresh_token_expires_leeway": 0,
      "ssl_verify": true,
      "timeout": 3000,
      "token_endpoint": "http://host.docker.internal:8080/realms/apisix_test_realm/protocol/openid-connect/token"
    },
    "cors": {
      "allow_headers": "Authorization, Content-Type",
      "allow_methods": "GET, POST, OPTIONS",
      "allow_origins": "*"
    }
  },
  "upstream": {
    "nodes": [
      {
        "host": "host.docker.internal",
        "port": 8501,
        "weight": 1
      }
    ],
    "timeout": {
      "connect": 6,
      "send": 6,
      "read": 6
    },
    "type": "roundrobin",
    "scheme": "http",
    "pass_host": "pass",
    "keepalive_pool": {
      "idle_timeout": 60,
      "requests": 1000,
      "size": 320
    }
  },
  "status": 1
}

```

---

<div class="post-metadata">

**Author:** ![SKDragon18](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/skdragon18/32/11939_2.png) [@SKDragon18](https://forum.keycloak.org/u/SKDragon18)\
**Post date:** [March 9, 2025, 2:39pm UTC](https://forum.keycloak.org/t/webview-in-mobile-with-access-token/29718/2 "2025-03-09T14:39:56Z")

</div>

Expect: access [http://127.0.0.1:9080/service](http://127.0.0.1:9080/service)

---

<div class="post-metadata">

**Author:** ![Kostia](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/kostia/32/3788_2.png) [@Kostia](https://forum.keycloak.org/u/Kostia)\
**Post date:** [March 22, 2025, 8:51am UTC](https://forum.keycloak.org/t/webview-in-mobile-with-access-token/29718/3 "2025-03-22T08:51:39Z")

</div>

Maybe I got something wrong, but typically, WebView-like approaches are used to perform front-channel authentication. Then, in the back-channel part of the authorization code flow, you exchange the authorization code (retrieved via redirect) for a token, store the token in the keychain, and reuse it for interacting with your backends. The WebView, in this case, just operates with cookies (sso cookies) that could be useful for cookies based SSO authentication between mobile apps that reuse the same webview