My guess is that you are running the keycloak server not with the https protocol. Your client will then not accept the cookie coming from the server. Either use https or make the API call with {credentials: 'include'}. In Angular this would be { withCredentials: true }