diff --git a/plugins/azureadb2c/pkg/verify/verifier.go b/plugins/azureadb2c/pkg/verify/verifier.go
index 47ce217..7bf8eac 100644
--- a/plugins/azureadb2c/pkg/verify/verifier.go
+++ b/plugins/azureadb2c/pkg/verify/verifier.go
@@ -33,7 +33,7 @@ func (v *Verifier) Verify(ctx context.Context) error {
 	_, errReq := v.client.ListUsers(ctx, v.Groups, []string{"id"})
 
 	if errReq != nil {
-		return errors.Wrap(errReq, "failed to retrieve users from AzureAD")
+		return errors.Wrap(errReq, "failed to retrieve users from AzureAD (B2C)")
 	}
 
 	return nil
diff --git a/plugins/fusionauth/pkg/app/exec.go b/plugins/fusionauth/pkg/app/exec.go
index 3122a50..ee3ebf0 100644
--- a/plugins/fusionauth/pkg/app/exec.go
+++ b/plugins/fusionauth/pkg/app/exec.go
@@ -1,8 +1,8 @@
 package app
 
 import (
+	"github.com/aserto-dev/ds-load/plugins/fusionauth/pkg/client"
 	"github.com/aserto-dev/ds-load/plugins/fusionauth/pkg/fetch"
-	"github.com/aserto-dev/ds-load/plugins/fusionauth/pkg/fusionauthclient"
 	"github.com/aserto-dev/ds-load/sdk/common/cc"
 	"github.com/aserto-dev/ds-load/sdk/exec"
 	"github.com/aserto-dev/ds-load/sdk/transform"
@@ -14,7 +14,7 @@ type ExecCmd struct {
 }
 
 func (cmd *ExecCmd) Run(ctx *cc.CommonCtx) error {
-	fusionauthClient, err := fusionauthclient.NewFusionAuthClient(cmd.HostURL, cmd.APIKey)
+	fusionauthClient, err := client.NewFusionAuthClient(cmd.HostURL, cmd.APIKey)
 	if err != nil {
 		return err
 	}
diff --git a/plugins/fusionauth/pkg/app/fetch.go b/plugins/fusionauth/pkg/app/fetch.go
index 6ca0ffa..7085901 100644
--- a/plugins/fusionauth/pkg/app/fetch.go
+++ b/plugins/fusionauth/pkg/app/fetch.go
@@ -3,8 +3,8 @@ package app
 import (
 	"os"
 
+	"github.com/aserto-dev/ds-load/plugins/fusionauth/pkg/client"
 	"github.com/aserto-dev/ds-load/plugins/fusionauth/pkg/fetch"
-	"github.com/aserto-dev/ds-load/plugins/fusionauth/pkg/fusionauthclient"
 	"github.com/aserto-dev/ds-load/sdk/common"
 	"github.com/aserto-dev/ds-load/sdk/common/cc"
 )
@@ -16,7 +16,7 @@ type FetchCmd struct {
 }
 
 func (cmd *FetchCmd) Run(ctx *cc.CommonCtx) error {
-	fusionauthClient, err := fusionauthclient.NewFusionAuthClient(cmd.HostURL, cmd.APIKey)
+	fusionauthClient, err := client.NewFusionAuthClient(cmd.HostURL, cmd.APIKey)
 	if err != nil {
 		return err
 	}
diff --git a/plugins/fusionauth/pkg/app/verify.go b/plugins/fusionauth/pkg/app/verify.go
index ddfb7dd..b4ee7c3 100644
--- a/plugins/fusionauth/pkg/app/verify.go
+++ b/plugins/fusionauth/pkg/app/verify.go
@@ -1,7 +1,7 @@
 package app
 
 import (
-	"github.com/aserto-dev/ds-load/plugins/fusionauth/pkg/fusionauthclient"
+	"github.com/aserto-dev/ds-load/plugins/fusionauth/pkg/client"
 	"github.com/aserto-dev/ds-load/plugins/fusionauth/pkg/verify"
 	"github.com/aserto-dev/ds-load/sdk/common/cc"
 )
@@ -11,7 +11,7 @@ type VerifyCmd struct {
 }
 
 func (v *VerifyCmd) Run(ctx *cc.CommonCtx) error {
-	fusionauthClient, err := fusionauthclient.NewFusionAuthClient(v.HostURL, v.APIKey)
+	fusionauthClient, err := client.NewFusionAuthClient(v.HostURL, v.APIKey)
 	if err != nil {
 		return err
 	}
diff --git a/plugins/fusionauth/pkg/fusionauthclient/fusionauth.go b/plugins/fusionauth/pkg/client/client.go
similarity index 98%
rename from plugins/fusionauth/pkg/fusionauthclient/fusionauth.go
rename to plugins/fusionauth/pkg/client/client.go
index 79bc599..030d038 100644
--- a/plugins/fusionauth/pkg/fusionauthclient/fusionauth.go
+++ b/plugins/fusionauth/pkg/client/client.go
@@ -1,4 +1,4 @@
-package fusionauthclient
+package client
 
 import (
 	"context"
diff --git a/plugins/fusionauth/pkg/fetch/fetch.go b/plugins/fusionauth/pkg/fetch/fetch.go
index d9355f5..d7edeb1 100644
--- a/plugins/fusionauth/pkg/fetch/fetch.go
+++ b/plugins/fusionauth/pkg/fetch/fetch.go
@@ -6,18 +6,18 @@ import (
 	"fmt"
 	"io"
 
-	"github.com/aserto-dev/ds-load/plugins/fusionauth/pkg/fusionauthclient"
+	"github.com/aserto-dev/ds-load/plugins/fusionauth/pkg/client"
 	"github.com/aserto-dev/ds-load/sdk/common"
 	"github.com/aserto-dev/ds-load/sdk/common/js"
 )
 
 type Fetcher struct {
-	fusionauthClient *fusionauthclient.FusionAuthClient
+	fusionauthClient *client.FusionAuthClient
 	groups           bool
 	host             string
 }
 
-func New(client *fusionauthclient.FusionAuthClient) (*Fetcher, error) {
+func New(client *client.FusionAuthClient) (*Fetcher, error) {
 	return &Fetcher{
 		fusionauthClient: client,
 	}, nil
diff --git a/plugins/fusionauth/pkg/verify/verifier.go b/plugins/fusionauth/pkg/verify/verifier.go
index 61a7827..291a7ae 100644
--- a/plugins/fusionauth/pkg/verify/verifier.go
+++ b/plugins/fusionauth/pkg/verify/verifier.go
@@ -3,15 +3,15 @@ package verify
 import (
 	"context"
 
-	"github.com/aserto-dev/ds-load/plugins/fusionauth/pkg/fusionauthclient"
+	"github.com/aserto-dev/ds-load/plugins/fusionauth/pkg/client"
 	"github.com/pkg/errors"
 )
 
 type Verifier struct {
-	client *fusionauthclient.FusionAuthClient
+	client *client.FusionAuthClient
 }
 
-func New(ctx context.Context, client *fusionauthclient.FusionAuthClient) (*Verifier, error) {
+func New(ctx context.Context, client *client.FusionAuthClient) (*Verifier, error) {
 	return &Verifier{
 		client: client,
 	}, nil
diff --git a/plugins/jumpcloud/go.mod b/plugins/jumpcloud/go.mod
index bdce157..d2b8a90 100644
--- a/plugins/jumpcloud/go.mod
+++ b/plugins/jumpcloud/go.mod
@@ -9,6 +9,7 @@ replace github.com/aserto-dev/ds-load/sdk => ../../sdk
 require (
 	github.com/alecthomas/kong v1.10.0
 	github.com/aserto-dev/ds-load/sdk v0.0.0-20250408143332-e8965667fcc0
+	github.com/go-http-utils/headers v0.0.0-20181008091004-fed159eddc2a
 	github.com/pkg/errors v0.9.1
 	github.com/samber/lo v1.50.0
 	github.com/stretchr/testify v1.10.0
diff --git a/plugins/jumpcloud/go.sum b/plugins/jumpcloud/go.sum
index d6ab33d..b033b17 100644
--- a/plugins/jumpcloud/go.sum
+++ b/plugins/jumpcloud/go.sum
@@ -23,6 +23,8 @@ github.com/dongri/phonenumber v0.1.12 h1:rR/4VZzxqpocUdyM4dIdfY0TWd8FcW43oiyPaOU
 github.com/dongri/phonenumber v0.1.12/go.mod h1:cuHFSstIxh6qh/Qs/SCV3Grb/JMYregBLuXELvSYmT4=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/go-http-utils/headers v0.0.0-20181008091004-fed159eddc2a h1:v6zMvHuY9yue4+QkG/HQ/W67wvtQmWJ4SDo9aK/GIno=
+github.com/go-http-utils/headers v0.0.0-20181008091004-fed159eddc2a/go.mod h1:I79BieaU4fxrw4LMXby6q5OS9XnoR9UIKLOzDFjUmuw=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
diff --git a/plugins/jumpcloud/pkg/app/exec.go b/plugins/jumpcloud/pkg/app/exec.go
index 18f8f78..ef4b828 100644
--- a/plugins/jumpcloud/pkg/app/exec.go
+++ b/plugins/jumpcloud/pkg/app/exec.go
@@ -1,8 +1,8 @@
 package app
 
 import (
+	"github.com/aserto-dev/ds-load/plugins/jumpcloud/pkg/client"
 	"github.com/aserto-dev/ds-load/plugins/jumpcloud/pkg/fetch"
-	"github.com/aserto-dev/ds-load/plugins/jumpcloud/pkg/jc"
 	"github.com/aserto-dev/ds-load/sdk/common/cc"
 	"github.com/aserto-dev/ds-load/sdk/exec"
 	"github.com/aserto-dev/ds-load/sdk/transform"
@@ -14,7 +14,7 @@ type ExecCmd struct {
 }
 
 func (cmd *ExecCmd) Run(ctx *cc.CommonCtx) error {
-	gClient, err := jc.NewJumpCloudClient(ctx.Context, cmd.APIKey)
+	gClient, err := client.NewJumpCloudClient(ctx.Context, cmd.APIKey)
 	if err != nil {
 		return err
 	}
diff --git a/plugins/jumpcloud/pkg/app/fetch.go b/plugins/jumpcloud/pkg/app/fetch.go
index 63ed9bc..d85ed9b 100644
--- a/plugins/jumpcloud/pkg/app/fetch.go
+++ b/plugins/jumpcloud/pkg/app/fetch.go
@@ -3,8 +3,8 @@ package app
 import (
 	"os"
 
+	"github.com/aserto-dev/ds-load/plugins/jumpcloud/pkg/client"
 	"github.com/aserto-dev/ds-load/plugins/jumpcloud/pkg/fetch"
-	"github.com/aserto-dev/ds-load/plugins/jumpcloud/pkg/jc"
 	"github.com/aserto-dev/ds-load/sdk/common"
 	"github.com/aserto-dev/ds-load/sdk/common/cc"
 )
@@ -15,7 +15,7 @@ type FetchCmd struct {
 }
 
 func (cmd *FetchCmd) Run(ctx *cc.CommonCtx) error {
-	jcClient, err := jc.NewJumpCloudClient(ctx.Context, cmd.APIKey)
+	jcClient, err := client.NewJumpCloudClient(ctx.Context, cmd.APIKey)
 	if err != nil {
 		return err
 	}
diff --git a/plugins/jumpcloud/pkg/app/verify.go b/plugins/jumpcloud/pkg/app/verify.go
index 5e2bcdb..bae02ae 100644
--- a/plugins/jumpcloud/pkg/app/verify.go
+++ b/plugins/jumpcloud/pkg/app/verify.go
@@ -1,7 +1,7 @@
 package app
 
 import (
-	"github.com/aserto-dev/ds-load/plugins/jumpcloud/pkg/jc"
+	"github.com/aserto-dev/ds-load/plugins/jumpcloud/pkg/client"
 	"github.com/aserto-dev/ds-load/plugins/jumpcloud/pkg/verify"
 	"github.com/aserto-dev/ds-load/sdk/common/cc"
 )
@@ -11,7 +11,7 @@ type VerifyCmd struct {
 }
 
 func (v *VerifyCmd) Run(ctx *cc.CommonCtx) error {
-	gClient, err := jc.NewJumpCloudClient(ctx.Context, v.APIKey)
+	gClient, err := client.NewJumpCloudClient(ctx.Context, v.APIKey)
 	if err != nil {
 		return err
 	}
diff --git a/plugins/jumpcloud/pkg/jc/jc.go b/plugins/jumpcloud/pkg/client/client.go
similarity index 99%
rename from plugins/jumpcloud/pkg/jc/jc.go
rename to plugins/jumpcloud/pkg/client/client.go
index 754622f..d5f5c74 100644
--- a/plugins/jumpcloud/pkg/jc/jc.go
+++ b/plugins/jumpcloud/pkg/client/client.go
@@ -1,4 +1,4 @@
-package jc
+package client
 
 import (
 	"context"
diff --git a/plugins/jumpcloud/pkg/jc/group.go b/plugins/jumpcloud/pkg/client/group.go
similarity index 95%
rename from plugins/jumpcloud/pkg/jc/group.go
rename to plugins/jumpcloud/pkg/client/group.go
index 4740887..aae52a0 100644
--- a/plugins/jumpcloud/pkg/jc/group.go
+++ b/plugins/jumpcloud/pkg/client/group.go
@@ -1,4 +1,4 @@
-package jc
+package client
 
 const TypeGroup string = "group"
 
diff --git a/plugins/jumpcloud/pkg/jc/jc_test.go b/plugins/jumpcloud/pkg/client/jc_test.go
similarity index 77%
rename from plugins/jumpcloud/pkg/jc/jc_test.go
rename to plugins/jumpcloud/pkg/client/jc_test.go
index cff1a7e..d119281 100644
--- a/plugins/jumpcloud/pkg/jc/jc_test.go
+++ b/plugins/jumpcloud/pkg/client/jc_test.go
@@ -1,4 +1,4 @@
-package jc_test
+package client_test
 
 import (
 	"context"
@@ -7,7 +7,7 @@ import (
 	"os"
 	"testing"
 
-	"github.com/aserto-dev/ds-load/plugins/jumpcloud/pkg/jc"
+	"github.com/aserto-dev/ds-load/plugins/jumpcloud/pkg/client"
 	"github.com/stretchr/testify/require"
 )
 
@@ -27,7 +27,7 @@ func TestListDirectories(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	jcc, err := jc.NewJumpCloudClient(ctx, os.Getenv("JC_API_KEY"))
+	jcc, err := client.NewJumpCloudClient(ctx, os.Getenv("JC_API_KEY"))
 	require.NoError(t, err)
 
 	directories, err := jcc.ListDirectories(ctx)
@@ -46,7 +46,7 @@ func TestListUsers(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	jcc, err := jc.NewJumpCloudClient(ctx, os.Getenv("JC_API_KEY"))
+	jcc, err := client.NewJumpCloudClient(ctx, os.Getenv("JC_API_KEY"))
 	require.NoError(t, err)
 
 	users, err := jcc.ListUsers(ctx)
@@ -65,10 +65,10 @@ func TestListGroups(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	jcc, err := jc.NewJumpCloudClient(ctx, os.Getenv("JC_API_KEY"))
+	jcc, err := client.NewJumpCloudClient(ctx, os.Getenv("JC_API_KEY"))
 	require.NoError(t, err)
 
-	groups, err := jcc.ListGroups(ctx, jc.AllGroups)
+	groups, err := jcc.ListGroups(ctx, client.AllGroups)
 	require.NoError(t, err)
 
 	enc := json.NewEncoder(os.Stderr)
@@ -84,10 +84,10 @@ func TestGetSystemGroups(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	jcc, err := jc.NewJumpCloudClient(ctx, os.Getenv("JC_API_KEY"))
+	jcc, err := client.NewJumpCloudClient(ctx, os.Getenv("JC_API_KEY"))
 	require.NoError(t, err)
 
-	groups, err := jcc.ListGroups(ctx, jc.SystemGroups)
+	groups, err := jcc.ListGroups(ctx, client.SystemGroups)
 	require.NoError(t, err)
 
 	enc := json.NewEncoder(os.Stderr)
@@ -103,10 +103,10 @@ func TestGetUserGroups(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	jcc, err := jc.NewJumpCloudClient(ctx, os.Getenv("JC_API_KEY"))
+	jcc, err := client.NewJumpCloudClient(ctx, os.Getenv("JC_API_KEY"))
 	require.NoError(t, err)
 
-	groups, err := jcc.ListGroups(ctx, jc.UserGroups)
+	groups, err := jcc.ListGroups(ctx, client.UserGroups)
 	require.NoError(t, err)
 
 	enc := json.NewEncoder(os.Stderr)
@@ -122,18 +122,18 @@ func TestExpandMembersOfGroup(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	jcc, err := jc.NewJumpCloudClient(ctx, os.Getenv("JC_API_KEY"))
+	jcc, err := client.NewJumpCloudClient(ctx, os.Getenv("JC_API_KEY"))
 	require.NoError(t, err)
 
 	users, err := jcc.ListUsers(ctx)
 	require.NoError(t, err)
 
-	idLookup := map[string]*jc.BaseUser{}
+	idLookup := map[string]*client.BaseUser{}
 	for _, u := range users {
 		idLookup[u.ID] = &u.BaseUser
 	}
 
-	groups, err := jcc.ListGroups(ctx, jc.UserGroups)
+	groups, err := jcc.ListGroups(ctx, client.UserGroups)
 	require.NoError(t, err)
 
 	enc := json.NewEncoder(os.Stderr)
diff --git a/plugins/jumpcloud/pkg/jc/user.go b/plugins/jumpcloud/pkg/client/user.go
similarity index 99%
rename from plugins/jumpcloud/pkg/jc/user.go
rename to plugins/jumpcloud/pkg/client/user.go
index 2b68e25..330394c 100644
--- a/plugins/jumpcloud/pkg/jc/user.go
+++ b/plugins/jumpcloud/pkg/client/user.go
@@ -1,4 +1,4 @@
-package jc
+package client
 
 import "time"
 
diff --git a/plugins/jumpcloud/pkg/fetch/fetch.go b/plugins/jumpcloud/pkg/fetch/fetch.go
index 7cbedc2..575a81a 100644
--- a/plugins/jumpcloud/pkg/fetch/fetch.go
+++ b/plugins/jumpcloud/pkg/fetch/fetch.go
@@ -5,17 +5,17 @@ import (
 	"encoding/json"
 	"io"
 
-	"github.com/aserto-dev/ds-load/plugins/jumpcloud/pkg/jc"
+	"github.com/aserto-dev/ds-load/plugins/jumpcloud/pkg/client"
 	"github.com/aserto-dev/ds-load/sdk/common"
 	"github.com/aserto-dev/ds-load/sdk/common/js"
 )
 
 type Fetcher struct {
-	jcc    *jc.JumpCloudClient
+	jcc    *client.JumpCloudClient
 	Groups bool
 }
 
-func New(client *jc.JumpCloudClient) (*Fetcher, error) {
+func New(client *client.JumpCloudClient) (*Fetcher, error) {
 	return &Fetcher{
 		jcc: client,
 	}, nil
@@ -36,7 +36,7 @@ func (f *Fetcher) Fetch(ctx context.Context, outputWriter io.Writer, errorWriter
 		return err
 	}
 
-	idLookup := map[string]*jc.BaseUser{}
+	idLookup := map[string]*client.BaseUser{}
 
 	for _, user := range users {
 		userBytes, err := json.Marshal(user)
@@ -71,9 +71,9 @@ func (f *Fetcher) Fetch(ctx context.Context, outputWriter io.Writer, errorWriter
 func (f *Fetcher) fetchGroups(ctx context.Context,
 	writer *js.JSONArrayWriter,
 	errorWriter common.ErrorWriter,
-	idLookup map[string]*jc.BaseUser,
+	idLookup map[string]*client.BaseUser,
 ) error {
-	groups, err := f.jcc.ListGroups(ctx, jc.UserGroups)
+	groups, err := f.jcc.ListGroups(ctx, client.UserGroups)
 	if err != nil {
 		errorWriter.Error(err)
 		return err
diff --git a/plugins/jumpcloud/pkg/verify/verifier.go b/plugins/jumpcloud/pkg/verify/verifier.go
index 873c8d5..54348c5 100644
--- a/plugins/jumpcloud/pkg/verify/verifier.go
+++ b/plugins/jumpcloud/pkg/verify/verifier.go
@@ -3,15 +3,15 @@ package verify
 import (
 	"context"
 
-	"github.com/aserto-dev/ds-load/plugins/jumpcloud/pkg/jc"
+	"github.com/aserto-dev/ds-load/plugins/jumpcloud/pkg/client"
 	"github.com/pkg/errors"
 )
 
 type Verifier struct {
-	client *jc.JumpCloudClient
+	client *client.JumpCloudClient
 }
 
-func New(ctx context.Context, client *jc.JumpCloudClient) (*Verifier, error) {
+func New(ctx context.Context, client *client.JumpCloudClient) (*Verifier, error) {
 	return &Verifier{
 		client: client,
 	}, nil
@@ -21,7 +21,7 @@ func (v *Verifier) Verify(ctx context.Context) error {
 	_, errReq := v.client.ListUsers(ctx)
 
 	if errReq != nil {
-		return errors.Wrap(errReq, "failed to retrieve users from Google")
+		return errors.Wrap(errReq, "failed to retrieve users from JumpCloud")
 	}
 
 	return nil
diff --git a/plugins/keycloak/go.mod b/plugins/keycloak/go.mod
index bec5588..2678189 100644
--- a/plugins/keycloak/go.mod
+++ b/plugins/keycloak/go.mod
@@ -9,10 +9,11 @@ replace github.com/aserto-dev/ds-load/sdk => ../../sdk
 require (
 	github.com/alecthomas/kong v1.10.0
 	github.com/aserto-dev/ds-load/sdk v0.0.0-20250408143332-e8965667fcc0
+	github.com/go-http-utils/headers v0.0.0-20181008091004-fed159eddc2a
+	github.com/golang-jwt/jwt/v5 v5.2.2
 	github.com/pkg/errors v0.9.1
-	github.com/samber/lo v1.50.0
 	github.com/stretchr/testify v1.10.0
-	google.golang.org/grpc v1.72.0
+	golang.org/x/oauth2 v0.27.0
 )
 
 require (
@@ -45,6 +46,7 @@ require (
 	golang.org/x/text v0.25.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20250505200425-f936aa4a68b2 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250505200425-f936aa4a68b2 // indirect
+	google.golang.org/grpc v1.72.0 // indirect
 	google.golang.org/protobuf v1.36.6 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/plugins/keycloak/go.sum b/plugins/keycloak/go.sum
index d6ab33d..0fd21bc 100644
--- a/plugins/keycloak/go.sum
+++ b/plugins/keycloak/go.sum
@@ -23,11 +23,15 @@ github.com/dongri/phonenumber v0.1.12 h1:rR/4VZzxqpocUdyM4dIdfY0TWd8FcW43oiyPaOU
 github.com/dongri/phonenumber v0.1.12/go.mod h1:cuHFSstIxh6qh/Qs/SCV3Grb/JMYregBLuXELvSYmT4=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/go-http-utils/headers v0.0.0-20181008091004-fed159eddc2a h1:v6zMvHuY9yue4+QkG/HQ/W67wvtQmWJ4SDo9aK/GIno=
+github.com/go-http-utils/headers v0.0.0-20181008091004-fed159eddc2a/go.mod h1:I79BieaU4fxrw4LMXby6q5OS9XnoR9UIKLOzDFjUmuw=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
+github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
@@ -66,8 +70,6 @@ github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7
 github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
 github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
 github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
-github.com/samber/lo v1.50.0 h1:XrG0xOeHs+4FQ8gJR97zDz5uOFMW7OwFWiFVzqopKgY=
-github.com/samber/lo v1.50.0/go.mod h1:RjZyNk6WSnUFRKK6EyOhsRJMqft3G+pg7dCWHQCWvsc=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
 github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
@@ -90,6 +92,8 @@ golang.org/x/crypto v0.38.0 h1:jt+WWG8IZlBnVbomuhg2Mdq0+BBQaHbtqHEFEigjUV8=
 golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw=
 golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
 golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
+golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
+golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
diff --git a/plugins/keycloak/pkg/app/exec.go b/plugins/keycloak/pkg/app/exec.go
index f1b6707..b0900ff 100644
--- a/plugins/keycloak/pkg/app/exec.go
+++ b/plugins/keycloak/pkg/app/exec.go
@@ -1,8 +1,8 @@
 package app
 
 import (
+	"github.com/aserto-dev/ds-load/plugins/keycloak/pkg/client"
 	"github.com/aserto-dev/ds-load/plugins/keycloak/pkg/fetch"
-	"github.com/aserto-dev/ds-load/plugins/keycloak/pkg/kc"
 	"github.com/aserto-dev/ds-load/sdk/common/cc"
 	"github.com/aserto-dev/ds-load/sdk/exec"
 	"github.com/aserto-dev/ds-load/sdk/transform"
@@ -14,7 +14,7 @@ type ExecCmd struct {
 }
 
 func (cmd *ExecCmd) Run(ctx *cc.CommonCtx) error {
-	gClient, err := kc.NewKeycloakClient(ctx.Context, &cmd.KeycloakClientConfig)
+	gClient, err := client.NewKeycloakClient(ctx.Context, &cmd.KeycloakConfig)
 	if err != nil {
 		return err
 	}
diff --git a/plugins/keycloak/pkg/app/fetch.go b/plugins/keycloak/pkg/app/fetch.go
index 1911fa1..27490a9 100644
--- a/plugins/keycloak/pkg/app/fetch.go
+++ b/plugins/keycloak/pkg/app/fetch.go
@@ -3,20 +3,20 @@ package app
 import (
 	"os"
 
+	"github.com/aserto-dev/ds-load/plugins/keycloak/pkg/client"
 	"github.com/aserto-dev/ds-load/plugins/keycloak/pkg/fetch"
-	"github.com/aserto-dev/ds-load/plugins/keycloak/pkg/kc"
 	"github.com/aserto-dev/ds-load/sdk/common"
 	"github.com/aserto-dev/ds-load/sdk/common/cc"
 )
 
 type FetchCmd struct {
-	kc.KeycloakClientConfig
+	client.KeycloakConfig
 	Groups bool `short:"g" help:"Retrieve keycloak groups" env:"KEYCLOAK_GROUPS" default:"false"`
 	Roles  bool `short:"r"  help:"Retrieve keycloak roles" env:"KEYCLOAK_ROLES" default:"false"`
 }
 
 func (cmd *FetchCmd) Run(ctx *cc.CommonCtx) error {
-	kcClient, err := kc.NewKeycloakClient(ctx.Context, &cmd.KeycloakClientConfig)
+	kcClient, err := client.NewKeycloakClient(ctx.Context, &cmd.KeycloakConfig)
 	if err != nil {
 		return err
 	}
diff --git a/plugins/keycloak/pkg/app/verify.go b/plugins/keycloak/pkg/app/verify.go
index ed6178f..b8231cf 100644
--- a/plugins/keycloak/pkg/app/verify.go
+++ b/plugins/keycloak/pkg/app/verify.go
@@ -1,7 +1,7 @@
 package app
 
 import (
-	"github.com/aserto-dev/ds-load/plugins/keycloak/pkg/kc"
+	"github.com/aserto-dev/ds-load/plugins/keycloak/pkg/client"
 	"github.com/aserto-dev/ds-load/plugins/keycloak/pkg/verify"
 	"github.com/aserto-dev/ds-load/sdk/common/cc"
 )
@@ -11,7 +11,7 @@ type VerifyCmd struct {
 }
 
 func (v *VerifyCmd) Run(ctx *cc.CommonCtx) error {
-	gClient, err := kc.NewKeycloakClient(ctx.Context, &v.KeycloakClientConfig)
+	gClient, err := client.NewKeycloakClient(ctx.Context, &v.KeycloakConfig)
 	if err != nil {
 		return err
 	}
diff --git a/plugins/keycloak/pkg/kc/kc.go b/plugins/keycloak/pkg/client/client.go
similarity index 95%
rename from plugins/keycloak/pkg/kc/kc.go
rename to plugins/keycloak/pkg/client/client.go
index 9a93f76..b494a15 100644
--- a/plugins/keycloak/pkg/kc/kc.go
+++ b/plugins/keycloak/pkg/client/client.go
@@ -1,4 +1,4 @@
-package kc
+package client
 
 import (
 	"context"
@@ -20,21 +20,21 @@ const (
 	defaultConnectionTimeout = 30 * time.Second
 )
 
-type KeycloakClientConfig struct {
+type KeycloakConfig struct {
 	TokenURL     string `name:"token-url" short:"u" env:"KEYCLOAK_TOKEN_URL" help:"keycloak token URL" required:""`
 	ClientID     string `name:"client-id" short:"i" env:"KEYCLOAK_CLIENT_ID" help:"keycloak client id" required:""`
 	ClientSecret string `name:"client-secret" short:"s" env:"KEYCLOAK_CLIENT_SECRET" help:"keycloak client secret" required:""`
 }
 
 type KeycloakClient struct {
-	config   *KeycloakClientConfig
+	config   *KeycloakConfig
 	token    *oauth2.Token
 	adminURL string
 	headers  map[string]string
 	timeout  time.Duration
 }
 
-func NewKeycloakClient(ctx context.Context, cfg *KeycloakClientConfig) (*KeycloakClient, error) {
+func NewKeycloakClient(ctx context.Context, cfg *KeycloakConfig) (*KeycloakClient, error) {
 	token, err := accessToken(ctx, cfg)
 	if err != nil {
 		return nil, err
@@ -71,7 +71,7 @@ func NewKeycloakClient(ctx context.Context, cfg *KeycloakClientConfig) (*Keycloa
 	}, nil
 }
 
-func accessToken(ctx context.Context, cfg *KeycloakClientConfig) (*oauth2.Token, error) {
+func accessToken(ctx context.Context, cfg *KeycloakConfig) (*oauth2.Token, error) {
 	cc := clientcredentials.Config{
 		ClientID:     cfg.ClientID,
 		ClientSecret: cfg.ClientSecret,
diff --git a/plugins/keycloak/pkg/kc/group.go b/plugins/keycloak/pkg/client/group.go
similarity index 97%
rename from plugins/keycloak/pkg/kc/group.go
rename to plugins/keycloak/pkg/client/group.go
index 6daca12..b701569 100644
--- a/plugins/keycloak/pkg/kc/group.go
+++ b/plugins/keycloak/pkg/client/group.go
@@ -1,4 +1,4 @@
-package kc
+package client
 
 //nolint:tagliatelle // maintain json user formatting
 type Group struct {
diff --git a/plugins/keycloak/pkg/kc/kc_test.go b/plugins/keycloak/pkg/client/kc_test.go
similarity index 88%
rename from plugins/keycloak/pkg/kc/kc_test.go
rename to plugins/keycloak/pkg/client/kc_test.go
index fb9e422..014814b 100644
--- a/plugins/keycloak/pkg/kc/kc_test.go
+++ b/plugins/keycloak/pkg/client/kc_test.go
@@ -1,5 +1,5 @@
 //molint:dupl
-package kc_test
+package client_test
 
 import (
 	"context"
@@ -8,7 +8,7 @@ import (
 	"os"
 	"testing"
 
-	"github.com/aserto-dev/ds-load/plugins/keycloak/pkg/kc"
+	"github.com/aserto-dev/ds-load/plugins/keycloak/pkg/client"
 	"github.com/stretchr/testify/require"
 )
 
@@ -28,8 +28,8 @@ func TestMain(m *testing.M) {
 	os.Exit(exitVal)
 }
 
-func keycloakClientConfig() *kc.KeycloakClientConfig {
-	return &kc.KeycloakClientConfig{
+func keycloakClientConfig() *client.KeycloakConfig {
+	return &client.KeycloakConfig{
 		ClientID:     os.Getenv(EnvKeyCloakClientID),
 		ClientSecret: os.Getenv(EnvKeycloakClientSecret),
 		TokenURL:     os.Getenv(EnvKeyCloakTokenURL),
@@ -40,7 +40,7 @@ func TestListUsers(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	kcc, err := kc.NewKeycloakClient(ctx, keycloakClientConfig())
+	kcc, err := client.NewKeycloakClient(ctx, keycloakClientConfig())
 	require.NoError(t, err)
 
 	users, err := kcc.ListUsers(ctx)
@@ -59,7 +59,7 @@ func TestListGroups(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	kcc, err := kc.NewKeycloakClient(ctx, keycloakClientConfig())
+	kcc, err := client.NewKeycloakClient(ctx, keycloakClientConfig())
 	require.NoError(t, err)
 
 	groups, err := kcc.ListGroups(ctx)
@@ -78,7 +78,7 @@ func TestListRoles(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	kcc, err := kc.NewKeycloakClient(ctx, keycloakClientConfig())
+	kcc, err := client.NewKeycloakClient(ctx, keycloakClientConfig())
 	require.NoError(t, err)
 
 	roles, err := kcc.ListRoles(ctx)
@@ -97,7 +97,7 @@ func TestGetRolesOfUser(t *testing.T) { //nolint:dupl
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	kcc, err := kc.NewKeycloakClient(ctx, keycloakClientConfig())
+	kcc, err := client.NewKeycloakClient(ctx, keycloakClientConfig())
 	require.NoError(t, err)
 
 	users, err := kcc.ListUsers(ctx)
@@ -129,7 +129,7 @@ func TestGetRolesOfGroup(t *testing.T) { //nolint:dupl
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	kcc, err := kc.NewKeycloakClient(ctx, keycloakClientConfig())
+	kcc, err := client.NewKeycloakClient(ctx, keycloakClientConfig())
 	require.NoError(t, err)
 
 	groups, err := kcc.ListGroups(ctx)
@@ -161,7 +161,7 @@ func TestGetUsersOfRole(t *testing.T) { //nolint:dupl
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	kcc, err := kc.NewKeycloakClient(ctx, keycloakClientConfig())
+	kcc, err := client.NewKeycloakClient(ctx, keycloakClientConfig())
 	require.NoError(t, err)
 
 	roles, err := kcc.ListRoles(ctx)
@@ -193,7 +193,7 @@ func TestGetUsersOfGroup(t *testing.T) { //nolint:dupl
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	kcc, err := kc.NewKeycloakClient(ctx, keycloakClientConfig())
+	kcc, err := client.NewKeycloakClient(ctx, keycloakClientConfig())
 	require.NoError(t, err)
 
 	groups, err := kcc.ListGroups(ctx)
@@ -225,7 +225,7 @@ func TestGetGroupsOfUser(t *testing.T) { //nolint:dupl
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	kcc, err := kc.NewKeycloakClient(ctx, keycloakClientConfig())
+	kcc, err := client.NewKeycloakClient(ctx, keycloakClientConfig())
 	require.NoError(t, err)
 
 	users, err := kcc.ListUsers(ctx)
diff --git a/plugins/keycloak/pkg/kc/role.go b/plugins/keycloak/pkg/client/role.go
similarity index 97%
rename from plugins/keycloak/pkg/kc/role.go
rename to plugins/keycloak/pkg/client/role.go
index 7804a07..942cef4 100644
--- a/plugins/keycloak/pkg/kc/role.go
+++ b/plugins/keycloak/pkg/client/role.go
@@ -1,4 +1,4 @@
-package kc
+package client
 
 //nolint:tagliatelle // maintain json user formatting
 type Role struct {
diff --git a/plugins/keycloak/pkg/kc/user.go b/plugins/keycloak/pkg/client/user.go
similarity index 98%
rename from plugins/keycloak/pkg/kc/user.go
rename to plugins/keycloak/pkg/client/user.go
index b4c97c2..f130455 100644
--- a/plugins/keycloak/pkg/kc/user.go
+++ b/plugins/keycloak/pkg/client/user.go
@@ -1,4 +1,4 @@
-package kc
+package client
 
 //nolint:tagliatelle // maintain json user formatting
 type User struct {
diff --git a/plugins/keycloak/pkg/fetch/fetch.go b/plugins/keycloak/pkg/fetch/fetch.go
index 28fe3c6..6a3eddb 100644
--- a/plugins/keycloak/pkg/fetch/fetch.go
+++ b/plugins/keycloak/pkg/fetch/fetch.go
@@ -5,18 +5,18 @@ import (
 	"encoding/json"
 	"io"
 
-	"github.com/aserto-dev/ds-load/plugins/keycloak/pkg/kc"
+	"github.com/aserto-dev/ds-load/plugins/keycloak/pkg/client"
 	"github.com/aserto-dev/ds-load/sdk/common"
 	"github.com/aserto-dev/ds-load/sdk/common/js"
 )
 
 type Fetcher struct {
-	kcc    *kc.KeycloakClient
+	kcc    *client.KeycloakClient
 	Groups bool
 	Roles  bool
 }
 
-func New(client *kc.KeycloakClient) (*Fetcher, error) {
+func New(client *client.KeycloakClient) (*Fetcher, error) {
 	return &Fetcher{
 		kcc: client,
 	}, nil
diff --git a/plugins/keycloak/pkg/verify/verifier.go b/plugins/keycloak/pkg/verify/verifier.go
index 54db909..893de86 100644
--- a/plugins/keycloak/pkg/verify/verifier.go
+++ b/plugins/keycloak/pkg/verify/verifier.go
@@ -3,15 +3,15 @@ package verify
 import (
 	"context"
 
-	"github.com/aserto-dev/ds-load/plugins/keycloak/pkg/kc"
+	"github.com/aserto-dev/ds-load/plugins/keycloak/pkg/client"
 	"github.com/pkg/errors"
 )
 
 type Verifier struct {
-	client *kc.KeycloakClient
+	client *client.KeycloakClient
 }
 
-func New(ctx context.Context, client *kc.KeycloakClient) (*Verifier, error) {
+func New(ctx context.Context, client *client.KeycloakClient) (*Verifier, error) {
 	return &Verifier{
 		client: client,
 	}, nil
@@ -21,7 +21,7 @@ func (v *Verifier) Verify(ctx context.Context) error {
 	_, errReq := v.client.ListUsers(ctx)
 
 	if errReq != nil {
-		return errors.Wrap(errReq, "failed to retrieve users from Google")
+		return errors.Wrap(errReq, "failed to retrieve users from KeyCloak")
 	}
 
 	return nil