Pro: €39 excl. VAT / month for 3,000 attempts
1.3 euro cents excl. VAT per attempt at full usage. Failures and abandoned attempts included.
Keycloak · Identity verification
Connect Keycloak to EUDI Wallets for identity verification
Add “Sign in with your EUDI Wallet” to your Keycloak login screen. Wallet Connectors verifies the presented identity; your applications keep their Keycloak integration and access rules.
Compare plans →
Keycloak
What you can offer
Keep your applications in Keycloak
Configure an OpenID Connect identity provider in your realm. No Wallet-specific plugin is needed in each application.
Request identity attributes
Use openid profile to receive authorized attributes, including first and last names. This flow requests neither an 18+ proof nor a user email.
Control accounts and access
Keycloak manages first login and account linking. Roles and permissions remain under your control.
Video tutorial
Connect Keycloak to EUDI Wallet: identity verification
Add the OpenID Connect provider, create your connection and configure identity verification in your realm without requesting user email.
English audio · no subtitles
OpenID Connect
Install and connect
- In your realm, open Identity providers and add OpenID Connect v1.0. Choose a stable alias, such as eudi-wallet, then copy the exact redirect URI shown.
- Create a Wallet Connectors connection with Keycloak and Identity verification. Register your installation’s HTTPS callback, verify your contact email and download the private JSON.
- In Keycloak, use the OIDC discovery and credentials from the JSON. Select HTTP Basic, PKCE S256 and openid profile scopes. Keep signature and nonce validation enabled.
- Give the button a clear name. Review first login and require authentication to an existing account before linking. Test from an application connected to your realm.
Frequently asked questions
Do I need a Keycloak plugin?
No for this integration: use Keycloak’s built-in OpenID Connect provider. Your applications remain connected to their realm.
Do users need to provide an email?
No. This flow uses openid profile. If your realm profile requires email, adjust that requirement according to your policy before opening access.
Is an existing account automatically recognized?
The provider association uses its external sub identifier. First-time linking to an existing account must require authentication to that account; a name or email alone is insufficient.
Reference documentation
Read the guide
The technical guide covers settings, response validation and integration checks.