Signing in

The Borrower Portal uses OAuth 2.0 with the Authorization Code flow, backed by a dedicated Keycloak identity realm called BorrowerRealm. The portal client identifier is borrower-portal.

Authentication can be configured in two modes depending on the deployment:

• Phone-based (SMS flow): The borrower’s phone number serves as the username. Keycloak stores the phone number both as the username and as a verifiedPhoneNumber attribute.
• Email-based flow: The borrower’s email address serves as the username and is stored as both the Keycloak username and email.

A borrower account is created automatically during the first loan application, at which point a Keycloak user is provisioned in the BorrowerRealm. On subsequent visits, the borrower signs in using the same credential (phone or email) used during their initial application.