diff --git a/docs/how-it-works/gateways/authentication.mdx b/docs/how-it-works/gateways/authentication.mdx
index 436be775e1..232cd0f5a0 100644
--- a/docs/how-it-works/gateways/authentication.mdx
+++ b/docs/how-it-works/gateways/authentication.mdx
@@ -343,7 +343,7 @@ For example, a wrapper running the CLI in a container sets both variables and pu
 OPENSHELL_CALLBACK_PORT=18080 OPENSHELL_CALLBACK_BIND_ADDRESS=0.0.0.0 openshell gateway login
 ```
 
-The browser-facing callback URL derives from the bound address, so the callback matches the listener: IPv4 binds (including the default and `0.0.0.0`) use `http://127.0.0.1:<port>/callback`, and IPv6 binds use the bracketed RFC 8252 loopback form `http://[::1]:<port>/callback`. The bundled Keycloak realm allows `http://127.0.0.1:*`, `http://localhost:*`, and `http://[::1]:*` redirects for the CLI client; other identity providers that allowlist loopback redirects for native apps should include the `[::1]` form as well.
+The browser-facing callback URL derives from the bound address, so the callback matches the listener: IPv4 binds (including the default and `0.0.0.0`) use `http://127.0.0.1:<port>/callback`, and IPv6 binds use the bracketed RFC 8252 loopback form `http://[::1]:<port>/callback`. Identity providers that allowlist loopback redirects for native apps must include the `[::1]` form for IPv6 binds. The bundled Keycloak realm allows only `http://127.0.0.1:*` and `http://localhost:*`, because Keycloak rejects a port wildcard on an IPv6 literal, so IPv6 binds against it need an exact `http://[::1]:<port>/callback` redirect URI added to the `openshell-cli` client.
 
 **IPv6 limitation for edge login:** IPv6 callback binds are fully supported for OIDC login, but the edge browser flow has a known browser limitation. The gateway's connect page enforces a Content-Security-Policy that must allow the callback target, and Chrome does not currently support IPv6 literals in CSP `connect-src` source expressions. An IPv6-bound CLI (`OPENSHELL_CALLBACK_BIND_ADDRESS=::1` or `::`) therefore cannot complete edge login in Chrome: the page's POST to the callback is blocked by CSP and the page reports that it could not reach the CLI. This is a browser limitation, not a CLI or gateway defect; IPv6 edge login is best-effort until browsers implement IPv6 CSP source expressions. The IPv4 paths, including the container use case, are unaffected.
 
diff --git a/scripts/keycloak-realm.json b/scripts/keycloak-realm.json
index 224bb82890..0664d6160e 100644
--- a/scripts/keycloak-realm.json
+++ b/scripts/keycloak-realm.json
@@ -288,8 +288,8 @@
       "standardFlowEnabled": true,
       "directAccessGrantsEnabled": true,
       "serviceAccountsEnabled": false,
-      "redirectUris": ["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
-      "webOrigins": ["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"],
+      "redirectUris": ["http://127.0.0.1:*", "http://localhost:*"],
+      "webOrigins": ["http://127.0.0.1:*", "http://localhost:*"],
       "attributes": {
         "pkce.code.challenge.method": "S256"
       },