Authentication

The portal uses Keycloak as its identity provider. The frontend is configured as a public OpenID Connect client using Authorization Code flow with PKCE (S256). Identity providers such as Google and Microsoft, if enabled, are configured in Keycloak.

After sign-in, the portal calls the Developer Portal backend to load the developer profile. The backend is the source of truth for onboarding completion and validates the access token server-side.

Portal identity is not API authorization

Signing in to this portal does not create API credentials and does not authorize calls to production insurance APIs. API access is provisioned separately.

Local Keycloak client

For local development, configure the public client with the narrowest appropriate redirect URI and web origin. The default development origin is http://localhost:3000. Do not configure a client secret for the browser client.