How do you secure a Quarkus application with OIDC?

Quarkus secures applications against an OpenID Connect provider (Keycloak, Auth0, or any compliant provider) through the quarkus-oidc extension, which handles validating bearer tokens on incoming requests without the application needing to implement token validation logic itself.

quarkus.oidc.auth-server-url=https://auth.example.com/realms/myrealm
quarkus.oidc.client-id=my-quarkus-app
quarkus.oidc.credentials.secret=my-client-secret

@Path("/secured")
public class SecuredResource {

    @GET
    @RolesAllowed("user")
    public String hello(@Context SecurityContext ctx) {
        return "Hello, " + ctx.getUserPrincipal().getName();
    }
}

Once configured, the extension automatically validates the token's signature against the provider's published keys, checks standard claims like expiration, and populates the security context so standard Jakarta annotations like @RolesAllowed and @Authenticated work directly on REST endpoints exactly as they would with any other security mechanism.

The extension also supports different application types out of the box — a pure API service validating bearer tokens, or a traditional web app using the authorization code flow with redirect-based login — configured via the quarkus.oidc.application-type property, so the same extension covers both service-to-service and browser-based user login scenarios.