diff --git a/docker/OpenResty-Orthanc-Keycloak/config/nginx.conf b/docker/OpenResty-Orthanc-Keycloak/config/nginx.conf
index 1f0bb7eb5..894b4e087 100644
--- a/docker/OpenResty-Orthanc-Keycloak/config/nginx.conf
+++ b/docker/OpenResty-Orthanc-Keycloak/config/nginx.conf
@@ -70,47 +70,74 @@ http {
 
         server_tokens off; # Hides server version num
 
-        # [PROTECTED] Reverse Proxy for `orthanc`
+        # [PROTECTED] Reverse Proxy for `orthanc` admin
         #
-        location /pacs/ {
-
-          # Sample configurations:
-          # https://github.com/zmartzone/lua-resty-openidc#sample-configuration-for-google-signin
-          # https://gist.github.com/alhafoudh/e87392ee60cf14bb33962847f5a84b24
-          # https://www.jerney.io/secure-apis-kong-keycloak-1/
+        location /pacs-admin/ {
           access_by_lua_block {
             local opts = {
               redirect_uri = "http://127.0.0.1/callback",
               discovery = "http://127.0.0.1/auth/realms/master/.well-known/openid-configuration",
               client_id = "pacs",
-              client_secret = "cd2b3a3c-a6c6-4a37-a15d-b2e5598735b6"
-              # accept_none_alg = true,
-              # ssl_verify = "no",
-              # redirect_uri_scheme = "http",
-              # logout_path = "/logout",
-              # redirect_after_logout_uri = "http://localhost:8080/auth/realms/internal/protocol/openid-connect/logout",
-              # edirect_after_logout_with_id_token_hint = false,
-              # session_contents = {id_token=true}
+              client_secret = "a726f5b1-5abd-42c9-b7b1-53a1a17d2ad2",
+              ssl_verify = "no",
+              redirect_uri_scheme = "http"
             }
 
-            # Call introspect for OAuth 2.0 Bearer Access Token validation
+            -- call authenticate for OpenID Connect user authentication
             local res, err = require("resty.openidc").authenticate(opts)
 
+            -- check session, but do not redirect to auth if not already logged in
+            -- local res, err = require("resty.openidc").authenticate(opts, nil, "pass")
+
             if err then
-              # Helpful for debugging errors:
-              # ngx.print(err)
-              # ngx.log(ngx.ERR, err)
-              ngx.status = 403
+              ngx.print(err)
+              ngx.status = 200
               ngx.say(err)
-              ngx.exit(ngx.HTTP_FORBIDDEN)
+              ngx.exit(ngx.HTTP_INTERNAL_SERVER_ERROR)
             end
 
-            ngx.req.set_header("X-User", res.id_token.sub)
+            ngx.req.set_header("X-USER", res.id_token.sub)
           }
 
-          proxy_set_header X-Real-IP  $remote_addr;
-          proxy_set_header X-Forwarded-For $remote_addr;
-          proxy_set_header Host $host;
+          proxy_http_version 1.1;
+
+          proxy_set_header Host               $host;
+          proxy_set_header X-Real-IP          $remote_addr;
+          proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto  $scheme;
+
+          expires           0;
+          add_header        Cache-Control private;
+
+          proxy_pass        http://orthanc:8042/;
+        }
+
+        # [PROTECTED] Reverse Proxy for `orthanc` APIs (including DICOMWeb)
+        #
+        location /pacs/ {
+          access_by_lua_block {
+            local opts = {
+              discovery = "http://127.0.0.1/auth/realms/master/.well-known/openid-configuration",
+            }
+
+            -- call bearer_jwt_verify for OAuth 2.0 JWT validation
+            local res, err = require("resty.openidc").bearer_jwt_verify(opts)
+
+            if err or not res then
+              ngx.status = 403
+              ngx.say(err and err or "no access_token provided")
+              ngx.exit(ngx.HTTP_FORBIDDEN)
+            end
+          }
+
+          proxy_http_version 1.1;
+
+          proxy_set_header Host               $host;
+          proxy_set_header X-Real-IP          $remote_addr;
+          proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
+          proxy_set_header X-Forwarded-Proto  $scheme;
+#         proxy_set_header        Upgrade $http_upgrade;
+#         proxy_set_header        Connection "upgrade";
 
           expires           0;
           add_header        Cache-Control private;