From my medium post on Keycloak auth in GraphQL

keycloak-connect-graphql-subscriptions-setup.js

const keycloakSubscriptionHandler = new KeycloakSubscriptionHandler({ keycloak })
new SubscriptionServer({
  execute,
  subscribe,
  schema: server.schema,
  onConnect: async (connectionParams, websocket, connectionContext) => {
    const token = await keycloakSubscriptionHandler.onSubscriptionConnect(connectionParams)
    return {
      kauth: new KeycloakSubscriptionContext(token)
    }
  }
}, {
  server: httpServer,
  path: '/graphql'
})