Most Keycloak users rely on enriched access tokens. This approach is efficient but often overexposes information, especially when those tokens are exposed to external parties. The Phantom Token Pattern offers an alternative: combining privacy-preserving opaque-style minimal tokens with backend tokens. This talk introduces the concept, explains how it aligns with Keycloak’s capabilities, and demonstrates how to implement it using lightweight tokens and an API gateway. Discover how to enhance privacy and control in your token architecture without compromising performance.