Credential Issuer: Authorization servers

Catalog ids: protocol.issuer.authorization-servers, protocol.issuer.authorization-server-profile
Scope: tenant and selected issuer instance

Open it

Navigation	Protocols > Credential Issuer > select an issuer > Authorization-server selection
Deep link	#tenant={tenant}&surface=issuer&instance={instance}&area=authorization-servers

An issuer can bind one or more tenant authorization-server resources. Each binding is addressed by the resource UUID and has an enabled state, default marker, revision, and optional grant allowlist. The issuer resolves that administrative UUID into protocol metadata; it is not emitted as a credential claim or wallet-facing identifier.

Selection precedence

Selection is deterministic:

1. issuance-template override;
2. credential-configuration override;
3. issuer's single enabled default binding.

The selected resource must be active and support every effective grant. An enabled multi-credential template must resolve all credentials to the same authorization server. Replacing or deleting an override uses the observed revision and fails with a conflict when another administrator changed it. The two override deletes carry that revision in a JSON request body, so a DELETE without one is rejected as a bad request:

{ "expectedRevision": 3 }

External OIDC and Keycloak

An external OAuth/OIDC resource is discovered from its issuer metadata. Configure the external client, redirect URI, scopes, client authentication, and claim mapping in the authorization-server resource/federation configuration, validate discovery, then bind the resource to the issuer. OIDC capability is required when the resource is used as a hosted sign-in upstream; OAuth2-only resources may still protect supported issuance flows.

Keycloak is therefore an external service configuration, not a special issuer mode. Its discovery issuer, client registration, redirect URIs, claims, and browser callback must be tested with the actual Keycloak realm and holder wallet.

REST operations

GET    /api/platform/config/v1/tenants/{tenantId}/oid4vci/issuers/{instanceId}/authorization-server-bindings
POST   /api/platform/config/v1/tenants/{tenantId}/oid4vci/issuers/{instanceId}/authorization-server-bindings
PUT    /api/platform/config/v1/tenants/{tenantId}/oid4vci/issuers/{instanceId}/authorization-server-bindings/{bindingId}
DELETE /api/platform/config/v1/tenants/{tenantId}/oid4vci/issuers/{instanceId}/authorization-server-bindings/{bindingId}
GET    /api/platform/config/v1/tenants/{tenantId}/oid4vci/issuers/{instanceId}/credential-configurations/{credentialConfigurationId}/authorization-server
PUT    /api/platform/config/v1/tenants/{tenantId}/oid4vci/issuers/{instanceId}/credential-configurations/{credentialConfigurationId}/authorization-server
DELETE /api/platform/config/v1/tenants/{tenantId}/oid4vci/issuers/{instanceId}/credential-configurations/{credentialConfigurationId}/authorization-server
GET    /api/platform/config/v1/tenants/{tenantId}/oid4vci/issuers/{instanceId}/issuance-templates/{templateId}/authorization-server
PUT    /api/platform/config/v1/tenants/{tenantId}/oid4vci/issuers/{instanceId}/issuance-templates/{templateId}/authorization-server
DELETE /api/platform/config/v1/tenants/{tenantId}/oid4vci/issuers/{instanceId}/issuance-templates/{templateId}/authorization-server
GET    /api/platform/config/v1/tenants/{tenantId}/oid4vci/issuers/{instanceId}/protocol-profile

See the Platform Config REST reference and the issuance guide for request/response examples, grant flow, and callback boundaries.