One verified identity

Keycloak identity for crypto portfolios | ChainsFlow

Keycloak authenticates the user, and its verified subject UUID directly owns local quotas, subscriptions and portfolio mappings.

Read-only centralized-exchange connections
Explicit coverage and synchronization state
A direct path into the working portfolio

Keycloak is the identity authority

Passwords, verification and recovery stay in Keycloak. ChainsFlow validates the Keycloak Bearer JWT instead of issuing a parallel identity.

The subject is the user ID

The Keycloak subject UUID is stored as users.id and referenced by user_portfolios. No identity mapping or application-session table is required.

Plans remain local

ChainsFlow owns Free and Pro quotas and Stripe subscription state because those are product rules, not identity-provider concerns.