I figured out where the problem lay with Keycloack's technicians. keycloak token introspection always fails with {"active":false} You need to make sure that you introspect the token using the same DNS hostname/port as the request. Unfortunately that's a not widely documented "feature" of Keycloak...

Thank you for your attention