title: Using keycloak as an IdP when building a Rest API - the protect() method returns HTML
body: <p>I'm trying to build a Rest API in NodeJS and I want to use Keycloak to secure it.</p>
  <p>I'm currently using keycloak-connect from npm to integrate it.</p>
  <p>The problem is that when an Authorization token is not attached to the Request at all, I get this page as a response in Postman and I don't want that.</p>
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;html lang=&quot;en&quot;&gt;
  
  &lt;head&gt;
      &lt;meta charset=&quot;utf-8&quot;&gt;
      &lt;title&gt;Error&lt;/title&gt;
  &lt;/head&gt;
  
  &lt;body&gt;
      &lt;pre&gt;TypeError: Cannot read properties of undefined (reading &amp;#39;keycloak-token&amp;#39;)&lt;br&gt; &amp;nbsp; &amp;nbsp;at SessionStore.get (C:\Users\Laura\Desktop\supercatalog\node_modules\keycloak-connect\stores\session-store.js:24:58)&lt;br&gt; &amp;nbsp; &amp;nbsp;at Keycloak.getGrant (C:\Users\Laura\Desktop\supercatalog\node_modules\keycloak-connect\keycloak.js:311:30)&lt;br&gt; &amp;nbsp; &amp;nbsp;at grantAttacher (C:\Users\Laura\Desktop\supercatalog\node_modules\keycloak-connect\middleware\grant-attacher.js:20:14)&lt;br&gt; &amp;nbsp; &amp;nbsp;at Layer.handle [as handle_request] (C:\Users\Laura\Desktop\supercatalog\node_modules\express\lib\router\layer.js:95:5)&lt;br&gt; &amp;nbsp; &amp;nbsp;at trim_prefix (C:\Users\Laura\Desktop\supercatalog\node_modules\express\lib\router\index.js:323:13)&lt;br&gt; &amp;nbsp; &amp;nbsp;at C:\Users\Laura\Desktop\supercatalog\node_modules\express\lib\router\index.js:284:7&lt;br&gt; &amp;nbsp; &amp;nbsp;at Function.process_params (C:\Users\Laura\Desktop\supercatalog\node_modules\express\lib\router\index.js:341:12)&lt;br&gt; &amp;nbsp; &amp;nbsp;at next (C:\Users\Laura\Desktop\supercatalog\node_modules\express\lib\router\index.js:275:10)&lt;br&gt; &amp;nbsp; &amp;nbsp;at adminRequest (C:\Users\Laura\Desktop\supercatalog\node_modules\keycloak-connect\middleware\admin.js:119:16)&lt;br&gt; &amp;nbsp; &amp;nbsp;at Layer.handle [as handle_request] (C:\Users\Laura\Desktop\supercatalog\node_modules\express\lib\router\layer.js:95:5)&lt;/pre&gt;
  &lt;/body&gt;
  
  &lt;/html&gt;
  </code></pre>
  <p>I want to return my own message, with my own HTTP status code (I currently get 500 internal server error).</p>
  <p>Here's the code which triggers my error:</p>
  <pre><code>import { getKeycloak } from '../../config/keycloak-config';
  
  let keycloak: Keycloak = getKeycloak();
  
  router.get('/', keycloak.protect(&quot;admin&quot;), (req:Request, res:Response):void =&gt; {
      
  });
  </code></pre>
  <p>and here's my keycloak configuration:</p>
  <pre><code>import express, {Application} from 'express';
  import { Keycloak as KeycloakType } from &quot;keycloak-connect&quot;;
  
  var session = require('express-session');
  var Keycloak = require('keycloak-connect');
  
  let _keycloak: KeycloakType;
  
  var memoryStore = new session.MemoryStore();
  
  let kcConfig = {
      clientId: 'rest-api',
      bearerOnly: true,
      serverUrl: 'http://localhost:8080/auth',
      realm: 'supercatalog',
      realmPublicKey: 'realm-public-key'
  };
  
  function getKeycloak() {
      if (_keycloak) {
          return _keycloak;
      } 
      console.log(&quot;Initializing Keycloak...&quot;);
      _keycloak = new Keycloak({ store: memoryStore }, kcConfig);
      return _keycloak;
  }
  
  export {getKeycloak, memoryStore};
  </code></pre>
  <p>When I hit that route, I get that HTML page and 500 HTTP status code.</p>
  <p>I want to send my own status code and a JSON. (or at least make keycloak-connect send a 401/403, not a 500)</p>
  <p>How can I do that?</p>