# Setting Up Keycloak as a Credential Issuer with OpenID4VCI

DevFeed: [Setting Up Keycloak as a Credential Issuer with OpenID4VCI](<https://devfeed.tech/articles/setting-up-keycloak-as-a-credential-issuer-with-openid4vci-31744.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2026/01/issue-credentials-over-openid4vci>)

Author: Rodrick Awambeng, Forkim Enjeckayang, Ingrid Kamga, Bertrand Ogen

Published: 2026-01-16T00:00:00Z

Content type: tutorial

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [Development](<https://devfeed.tech/topics/development.md>)

Tags: [experimental](<https://devfeed.tech/tags/experimental.md>), [guide](<https://devfeed.tech/tags/guide.md>), [idm](<https://devfeed.tech/tags/idm.md>), [interoperability](<https://devfeed.tech/tags/interoperability.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [oauth-2-0](<https://devfeed.tech/tags/oauth-2-0.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [privacy](<https://devfeed.tech/tags/privacy.md>), [saml](<https://devfeed.tech/tags/saml.md>), [sso](<https://devfeed.tech/tags/sso.md>)

## AI overview

This guide explains how to configure Keycloak as an OpenID4VCI verifiable credential issuer. It introduces the relationship between OpenID4VCI and OpenID4VP, describes credential issuance and presentation flows, and discusses privacy and interoperability. The article notes that Keycloak's OpenID4VCI support is experimental and uses Keycloak 26.5.0.

## Source excerpt

Before configuring Keycloak, it is helpful to understand its role in decentralized identity ecosystems. As a verifiable credential issuer, Keycloak can issue digitally signed credentials using the OpenID for Verifiable Credential Issuance (OpenID4VCI) protocol, allowing relying parties (also known as verifiers) to independently verify them without contacting the issuer. Keycloak implements OpenID4VCI, enabling the issuance of verifiable credentials (VCs) as digital proofs of identity or attributes. Configuring this functionality requires consistent setup across the realm, clients, and issuable credentials (client scopes). For example, consider the following scenario: The Keycloak OAuth SIG team wants to issue verifiable membership credentials to its members, including their name and email, which can later be presented at onsite or virtual events as proof of active membership. At the time of writing this blog, Keycloak's support for OpenID4VCI is still experimental. This guide uses the Keycloak 26.5.0 release. The feature is under active development and is expected to be promoted to preview in the future. Introduction to OpenID4VCI & OpenID4VP OpenID4VCI is a protocol developed by the OpenID Foundation that extends the OAuth 2.0 framework to support the secure and interoperable issuance of Verifiable Credentials (VCs). VCs are digital, tamper-evident representations of information, such as identity attributes or qualifications, which can be cryptographically verified without needing to contact the issuer at verification time. While this guide primarily focuses on OpenID for Verifiable Credential Issuance (OpenID4VCI), the overall trust architecture also includes OpenID for Verifiable Presentations (OpenID4VP), which governs how holders present credentials to verifiers. Together, these protocols enable decentralized identity ecosystems in which users (holders) retain control of their data and can share it selectively with verifiers. Figure 1. Triangle of trust or Issu