keycloak:
  url: ${KEYCLOAK_URL:http://localhost:8180}
  realm: demo
  admin:
    client-id: admin-svc
    # The demo secret from realm/demo-realm.json. Real deployments read this from a secret store.
    client-secret: ${KEYCLOAK_ADMIN_SECRET:admin-svc-demo-secret}

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          # The issuer must match the token's iss claim character for character, host included.
          issuer-uri: ${keycloak.url}/realms/${keycloak.realm}
          # Rejects tokens whose aud claim does not contain this value.
          audiences: spring-api