Keycloak
Add wallet login to every application in a Keycloak realm by registering Ver.iD as an OpenID Connect identity provider.
Register Ver.iD once as an OpenID Connect identity provider in a Keycloak realm, and every application connected to that realm can offer login with a digital identity wallet. Your applications keep talking to Keycloak; nothing changes on their side.
Keycloak brokers the login. Ver.iD Studio defines which wallets, credentials and trust frameworks are accepted and returns a signed ID token with the claims you requested. Keycloak validates that token, creates or links the user, and stores the wallet claims as attributes you can pass on to applications.
How it works
- The user chooses Log in with Digital Identity Wallet on the Keycloak login page.
- Keycloak redirects the browser to Ver.iD with an OpenID Connect authorization request.
- Ver.iD shows the request and the user approves it in their wallet.
- Ver.iD redirects back to Keycloak's broker endpoint with an authorization code.
- Keycloak exchanges the code, validates the ID token against Ver.iD's published keys, and runs the first-login flow.
- Keycloak creates or links the user, imports the wallet claims, and completes the login for the application.
What you need
| Requirement | Where to get it |
|---|---|
| Administrator access to a Keycloak realm | Your Keycloak installation |
| A Studio organization with verification enabled, wallets activated and trust frameworks enrolled | Prepare your organization |
| An active authentication flow in Studio with the scopes you want to receive | Create an authentication |
| An OAuth client secret attached to that flow | OAuth client secrets |
You use these values throughout the guide:
| Value | Description |
|---|---|
<keycloak-base-url> | Keycloak's externally reachable base URL without a trailing slash, including a deployment path such as /auth when applicable. Use HTTPS in production. |
<realm> | The realm in which you configure Ver.iD. |
| Client ID | The authentication flow's client identifier, shown under Configuration in Studio. |
| Client Secret | The Key (as base64url) value of the flow's attached OAUTH secret, not its key identifier. |
| Broker callback | <keycloak-base-url>/realms/<realm>/broker/verid/endpoint |
Supported versions
This guide shows Keycloak 26.8.1. Keycloak 24 and 25 work with the same settings; the menu labels that differ are listed under Keycloak 24 and 25 differences.
Keycloak 26 also ships native OID4VCI and OID4VP features in preview. Leave them disabled for this integration. Wallets, issuance, verification and trust frameworks are configured in Studio.
Next steps
Follow the setup guide. It takes about thirty minutes and ends with a tested wallet login that delivers verified email and phone claims to your applications.