Skip to main content
Deployed as a tenant of the Hill90 homelab — hill90.com serves the UI, and identity comes from the homelab’s Keycloak at auth.hill90.com, realm platform. Verified 2026-08-06 07:45 UTC: 23 containers running, 0 unhealthy — the homelab’s 16 and the application’s 7.Identity and data are the platform’s. The tenant’s databases sit on the homelab’s Postgres under a dedicated non-superuser role, and app-auth.hill90.com is not a live surface — it returns 404. Authorization uses client roles on the hill90-ui client rather than realm roles, so holding a homelab realm role does not by itself grant access to the application. A local stack runs its own Postgres, and --standalone its own Keycloak, so pages describing those locally remain accurate.Signing in was completed on 2026-07-30, reported by the operator who performed it. That is not independently re-verified here: realm platform has event storage disabled, so there is no server-side record left to read.Where a page in this section disagrees with AI Application, the overview is newer.

​
Authentication

Hill90 uses Keycloak as its identity provider, implementing the OpenID Connect (OIDC) and OAuth 2.0 protocols.

​
How It Works

  1. Users authenticate through the Keycloak login page at auth.hill90.com, realm platform — the homelab’s Keycloak. The application’s own was retired on 2026-07-30 and app-auth.hill90.com returns 404. (Local development authenticates against that same homelab Keycloak, realm platform, and has since 2026-08-01. The self-contained --standalone fork runs its own Keycloak on localhost:18080, also realm platform — neither path uses app-auth.)
  2. Keycloak issues a JWT (JSON Web Token) upon successful authentication
  3. API requests include the JWT in the Authorization: Bearer <token> header
  4. Backend services validate the JWT signature and claims on every request

​
Roles

These are client roles on the hill90-ui client, not realm roles, and the application reads only the client ones. The distinction is load-bearing: realm platform has its own realm roles — including one also named admin — and holding that realm role does not grant administrative access to this application. Verified 2026-07-31: both client roles exist on hill90-ui and are granted per account.

​
UI Authentication

The Next.js frontend uses Auth.js v5 for session management. When you sign in through the UI, Auth.js handles the OIDC flow with Keycloak and maintains your session automatically.

​
API Authentication

For direct API access, include your JWT bearer token in the Authorization header:
A full guide on obtaining tokens programmatically (e.g., via the Keycloak token endpoint) will be added in a future update.

​
Next Steps

  • API Reference — See which endpoints require authentication
  • Services — Learn about individual service responsibilities