Bureaublad card api requests return 401

[Wqrld]

Bug Report

Problematic behavior

Cards do not load their content correctly, and the networking tab shows 401's for /api/v1/(app). This happens for all apps
GET https://bureaublad.mijnbureau.rabevcqhguoovcu.xyz/api/v1/meet/rooms?page=1&page_size=3 401

Might or might not be related to ba7984d . My knowledge of oidc/keycloak is too limited to easily debug this.

Steps to Reproduce

1. Fresh mijnbureau demo install
2. View bureaublad

Environment

• Product version: bfa9ec3
• Platform: bare metal k8s install

Additional
Backend doesn't show much more information

│ [2026-02-23 15:20:55 +0000](INFO,app.middleware.logging)[ee470cb7557ef49ccf7c5a94b6626f8c]: {"method": "GET", "path": "/api/v1/auth/profile", "status_code": 401, "duration_ms": 0.44}                         │
│ INFO:     188.91.204.185:0 - "GET /api/v1/auth/profile HTTP/1.1" 401 Unauthorized                                                                                                                                                                                                                                                    │
│ [2026-02-23 15:20:56 +0000](INFO,app.middleware.logging)[442696fd3c5032e0f02c2584854b66f6]: {"method": "GET", "path": "/api/v1/docs/documents", "status_code": 401, "duration_ms": 0.4, "query_params": "favor │
│ INFO:     188.91.204.185:0 - "GET /api/v1/docs/documents?favorite=false&page=1&page_size=3 HTTP/1.1" 401 Unauthorized

[berrydenhartog]

Thank you for reporting this issue. The problem is probably the identity provider configuration. We use a feature called token exchange, which is an advanced feature, that not all identity providers support. Are you using the keycloak from MijnBureau or your identity provider?

This is the token exchange spec: https://datatracker.ietf.org/doc/html/rfc8693

If you are interrested in reading more about it for keycloak i recommend this artikel: https://www.keycloak.org/securing-apps/token-exchange

[Wqrld]

I am indeed just using the keycloak built into mijnbureau.

[berrydenhartog]

mmm, then it should have worked. I will check the configurations