OIDC with PKCE through Keycloak
The client is a browser app, which can’t keep a secret; PKCE is the flow for that case.
Rolled out from staging to production.
Analyzer
An AI service that scores websites by the emotions their pages evoke, so ads can be placed where the mood fits. DSP2 uses those scores for site selection. I’m its main contributor: I took it from no authentication to Keycloak, and I ran the study that measured whether its scores could be trusted.
Reset Digital, 2025 – now. Authentication, access model, LLM evaluation, client UI.
React 19, Vite, MUI, oidc-client-ts, Python API, MySQL, Keycloak, Nginx, Docker Compose. Private codebase. Screens are Reset GUI components in Storybook, with mock data.
- From no authentication to Keycloak
OIDC with PKCE, rolled out from staging to production.
- A 500-domain study that changed the roadmap
It showed the scores weren’t reliable enough as they were, and set the baseline the team measures against.
- Better campaigns for clients
Once ads were matched to sites by emotional fit, client campaigns performed better.
Context
Analyzer uses an LLM to give each website an emotional profile and a propensity score. DSP2 reads those scores when advertisers pick sites. When I started, the app had no authentication and there was no baseline for how reliable its scores were.
My role
I’m the main contributor, and I did all of the authentication work. I designed the access model, ran the rollout, and designed and ran the scoring study.
Measuring the scores
Before changing the pipeline, I measured it. The study used a random sample of 500 domains, drawn with a fixed seed from a real client site list, and touched nothing in production.
- Reruns of the same pipeline, to check whether scores were reproducible.
- Controls to check whether the scores depended on the page content or on something else.
- The cost and coverage of each way to fetch real page content.
The whole study cost about USD 15 in model calls, plus scraping credits. It showed the scores weren’t reliable enough as they were and gave the team a baseline to measure every later change against. The specific figures are internal to Reset Digital.
Decisions
Roles by attribute, per entity
Accounts sit in a four-level hierarchy.
An attribute-based access model behind per-entity roles.
A measuring harness outside the product
To measure the pipeline without changing it, the harness runs the production prompt extracted byte for byte. If the prompt differs even in whitespace, every comparison is suspect.
Production stayed untouched while it was measured.
Architecture
How a request is authenticated. Simplified.
Interface
Contact
Open to design engineering and full-stack roles, in Buenos Aires or remote (UTC−3). Spanish (native), English (professional, spoken and written).