diff --git a/config/docker/keycloak/meldestelle-realm.json b/config/docker/keycloak/meldestelle-realm.json
index 81c6bc7d..b88ede80 100644
--- a/config/docker/keycloak/meldestelle-realm.json
+++ b/config/docker/keycloak/meldestelle-realm.json
@@ -209,7 +209,7 @@
       "protocol": "openid-connect",
       "attributes": {
         "pkce.code.challenge.method": "S256",
-        "post.logout.redirect.uris": "http://localhost:8080/*##http://localhost:4000/*##http://localhost:3000/*##https://app.meldestelle.at/*##https://app.mo-code.at/*"
+        "post.logout.redirect.uris": "http://localhost:8080/##http://localhost:4000/##http://localhost:3000/##https://app.meldestelle.at/*##https://app.mo-code.at/*"
       }
     },
     {
@@ -218,7 +218,7 @@
       "description": "Confidential client for backend testing via Postman",
       "enabled": true,
       "clientAuthenticatorType": "client-secret",
-      "secret": "${KC_POSTMAN_CLIENT_SECRET}",
+      "secret": "postman-secret-123",
       "redirectUris": [
         "https://oauth.pstmn.io/v1/callback"
       ],
@@ -287,7 +287,7 @@
       "credentials": [
         {
           "type": "password",
-          "value": "${KC_BOOTSTRAP_ADMIN_PASSWORD}",
+          "value": "Admin#1234",
           "temporary": false
         }
       ],
diff --git a/frontend/shells/meldestelle-portal/src/jsMain/resources/sw.js b/frontend/shells/meldestelle-portal/src/jsMain/resources/sw.js
index 0f588771..d6868704 100644
--- a/frontend/shells/meldestelle-portal/src/jsMain/resources/sw.js
+++ b/frontend/shells/meldestelle-portal/src/jsMain/resources/sw.js
@@ -1,6 +1,6 @@
 const IS_DEV = self.location.hostname === 'localhost' || self.location.hostname === '127.0.0.1' || self.location.hostname === '::1';
 
-const CACHE_NAME = 'meldestelle-cache-v3';
+const CACHE_NAME = 'meldestelle-cache-v4';
 const PRECACHE_URLS = [
   '/',
   '/index.html',
@@ -75,6 +75,12 @@ self.addEventListener('fetch', (event) => {
     return;
   }
 
+  // API-Requests immer direkt vom Netzwerk – niemals aus dem Cache (Auth-Header müssen erhalten bleiben)
+  if (url.pathname.startsWith('/api/')) {
+    event.respondWith(fetch(req));
+    return;
+  }
+
   // App-Bundle immer vom Netzwerk – niemals aus dem Cache (verhindert veraltete JS-Versionen)
   if (url.pathname.endsWith('web-app.js') || url.pathname.endsWith('web-app.js.map')) {
     event.respondWith(fetch(req));