diff --git a/api-management/access-control/sessions-and-keys/issuing-tokens-via-tib.mdx b/api-management/access-control/sessions-and-keys/issuing-tokens-via-tib.mdx
index 12de485e61..5a9997a076 100644
--- a/api-management/access-control/sessions-and-keys/issuing-tokens-via-tib.mdx
+++ b/api-management/access-control/sessions-and-keys/issuing-tokens-via-tib.mdx
@@ -111,13 +111,13 @@ This flow uses the `GenerateOAuthTokenForClient` [action](/tyk-identity-broker/o
 | `ID` | Required | Unique identifier for this profile. Forms part of the TIB authentication URL; see [Profile](/tyk-identity-broker/overview#profile). |
 | `IdentityHandlerConfig.DashboardCredential` | Required | The [TIB service account's](/tyk-identity-broker/dashboard-sso#tib-service-account) Dashboard API key, used to invalidate previous tokens on re-authentication. |
 | `IdentityHandlerConfig.DisableOneTokenPerAPI` | Optional | Set to `true` to allow multiple active tokens per user. Defaults to `false`. See [Controlling Concurrent Sessions](#controlling-concurrent-sessions). |
-| `IdentityHandlerConfig.OAuth.APIListenPath` | Required | The listen path of the API; TIB uses this to call the OAuth authorize endpoint (`{listen_path}/tyk/oauth/authorize-client/`). |
+| `IdentityHandlerConfig.OAuth.APIListenPath` | Required | The listen path of the API, without a leading or trailing slash (for example `my-api`, not `/my-api/`). TIB uses this to call the OAuth authorize endpoint (`{listen_path}/tyk/oauth/authorize-client/`); a leading or trailing slash produces a malformed URL and the Gateway returns `405`. |
 | `IdentityHandlerConfig.OAuth.BaseAPIID` | Required | The ID of the API secured with Tyk's built-in OAuth 2.0 authorization server. |
 | `IdentityHandlerConfig.OAuth.ClientId` | Required | The client ID of the Tyk OAuth client registered for this API. |
 | `IdentityHandlerConfig.OAuth.RedirectURI` | Required | The redirect URI registered for the Tyk OAuth client. The token is returned to the client as a URL fragment at this address. |
 | `IdentityHandlerConfig.OAuth.ResponseType` | Required | `token` or `authorization_code`. Use `token` for SPAs and mobile apps. |
 | `IdentityHandlerConfig.OAuth.Secret` | Required | The client secret of the Tyk OAuth client. |
-| `IdentityHandlerConfig.OAuth.NoRedirect` | Optional | Set to `true` to return the token as JSON in the response body instead of redirecting. Useful for non-browser clients. Defaults to `false`. |
+| `IdentityHandlerConfig.OAuth.NoRedirect` | Optional | Set to `true` to return the token as JSON in the response body instead of redirecting. Useful for non-browser clients. Defaults to `false`, but always set this field explicitly; omitting it entirely can cause TIB to fail to process the request. |
 | `MatchedPolicyID` | Required | The ID of the policy to apply to the generated OAuth token. |
 | `OrgID` | Required | The Tyk Organisation ID. |
 | `ProviderConfig` | Required | IdP-specific connection settings. See the [Identity Provider guides](/tyk-identity-broker/overview#what-would-you-like-to-do). |
@@ -178,6 +178,72 @@ The following video demonstrates this flow end-to-end:
 ```
 
 
+### Keycloak (OAuth Token via OpenID Connect)
+
+This example uses [Keycloak](https://www.keycloak.org/) as an OpenID Connect identity provider to issue OAuth 2.0 tokens for API access. It is a working implementation of the *identity server* role described in [Integration with Identity Server](/api-management/authentication/oauth-2#integration-with-identity-server): TIB authenticates the user against Keycloak, then requests the Tyk access token on the client's behalf.
+
+1. Configure the Keycloak Client
+
+    Follow the [Configure Keycloak](/tyk-identity-broker/sso-keycloak#configure-keycloak) steps to create an OpenID Connect client with **Client authentication** enabled and the **Standard flow** selected. Set the client's **Valid redirect URIs** to:
+
+    ```
+    http://{tib-host}/auth/{profile-id}/openid-connect/callback
+    ```
+
+    Note the **Client ID**, **Client Secret**, and the realm's OIDC discovery URL, available from **Realm Settings > General > OpenID Endpoint Configuration**.
+
+2. Register an OAuth Client in Tyk Dashboard
+
+    As with the GitHub example, you need an OAuth client registered in Tyk Dashboard for the target API. See [Client App Registration](/api-management/authentication/oauth-2#client-app-registration) for details.
+
+3. IdP-Specific Profile Configuration
+
+    Configure the TIB profile for the [OAuth token flow](#issuing-oauth-tokens) setting `ProviderName` to `SocialProvider` and `Type` to `redirect`. The Keycloak-specific settings go in `ProviderConfig`, using the same fields as [Keycloak SSO](/tyk-identity-broker/sso-keycloak#tib-profile):
+
+```json expandable
+    {
+      "ProviderName": "SocialProvider",
+      "Type": "redirect",
+      "ProviderConfig": {
+        "CallbackBaseURL": "http://{tib-host}",
+        "FailureRedirect": "http://{app-domain}/login?fail=true",
+        "UseProviders": [
+          {
+            "Name": "openid-connect",
+            "Key": "{keycloak-client-id}",
+            "Secret": "{keycloak-client-secret}",
+            "Scopes": ["openid", "email", "profile"],
+            "DiscoverURL": "https://{keycloak-host}/realms/{realm-name}/.well-known/openid-configuration"
+          }
+        ]
+      }
+    }
+```
+
+    <Note>
+    Set `IdentityHandlerConfig.OAuth.NoRedirect` explicitly, even to `false`, in the `IdentityHandlerConfig` block shown in the [OAuth token flow](#issuing-oauth-tokens) template above. Omitting it entirely can cause TIB to fail to process the request.
+    </Note>
+
+4. Test the Flow
+
+    Navigate to the TIB authentication URL to start the flow:
+
+    ```
+    http://{tib-host}/auth/{profile-id}/openid-connect
+    ```
+
+    Log in with a Keycloak user. On success, TIB redirects the browser to the `RedirectURI` configured in the profile, with the Tyk access token appended as a URL fragment:
+
+    ```
+    http://{app-domain}:{port}/{auth-success-path}#access_token=...&expires_in=3600&token_type=bearer
+    ```
+
+    Use the `access_token` to call the protected API as described in [Auth Token](/api-management/authentication/bearer-token).
+
+<Note>
+Keycloak derives its OpenID Connect `issuer` from the hostname used in the inbound request, unless a fixed hostname is configured (`KC_HOSTNAME`). If the browser and TIB reach Keycloak through different hostnames or ports, TIB's token validation fails with an issuer mismatch. Use the same hostname and port for both, or set `KC_HOSTNAME` in Keycloak to a stable value.
+</Note>
+
 ### OAuth Token via LDAP
 
 This example authenticates the user against LDAP before issuing the OAuth token. It is useful for internal APIs that require valid OAuth tokens but where user identity is managed in an LDAP directory such as Active Directory, rather than a web-based IdP.
diff --git a/tyk-identity-broker/sso-keycloak.mdx b/tyk-identity-broker/sso-keycloak.mdx
index 2b5e46a743..f77455720b 100644
--- a/tyk-identity-broker/sso-keycloak.mdx
+++ b/tyk-identity-broker/sso-keycloak.mdx
@@ -9,7 +9,7 @@ sidebarTitle: "Keycloak"
 
 [Keycloak](https://www.keycloak.org/) is an open-source identity provider that supports OpenID Connect. TIB connects to Keycloak using `SocialProvider` with the `openid-connect` provider type.
 
-Before configuring your IdP and TIB profile, read [Dashboard SSO](/tyk-identity-broker/dashboard-sso) or [Portal SSO](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso) to understand the `ActionType`, `ReturnURL`, and `IdentityHandlerConfig` fields required for your use case.
+Before configuring your IdP and TIB profile, read [Dashboard SSO](/tyk-identity-broker/dashboard-sso), [Portal SSO](/tyk-stack/tyk-developer-portal/enterprise-developer-portal/managing-access/enable-sso), or [Issuing Tokens via TIB](/api-management/access-control/sessions-and-keys/issuing-tokens-via-tib) to understand the `ActionType`, `ReturnURL`, and `IdentityHandlerConfig` fields required for your use case.
 
 This page covers the Keycloak-specific configuration only.