@naturzukunft I feel like we're close. Let's take a step back. The FEP describes a way to provide a client_id to the OAuth 2.0 server that is itself an ActivityPub object. You can see the one for `ap` here: https://evanp.github.io/ap/client.jsonld Can keycloak extract the `redirectURI` property from that object?