OAuth 2.0 can feel abstract until you actually run it. Keycloak is a production-grade open-source identity provider that handles the auth server side, and Bruno is the API client you use on the testing side. Together they let you run every OAuth 2.0 grant type locally so you can see each step of the flow for real.