Phone + OTP demo

Sign in with a phone number, get gated, set a PIN, then confirm a transaction with it.

1 · Sign in

1
No password. A phone number and a code that arrives in the Keycloak log.

2 · The gate

2
The token is real and valid. It still cannot reach the API, because it carries onboarding_pending.

3 · Finish onboarding

3
The PIN becomes the Keycloak password and the role is removed. Your current token does not change — you have to refresh it.

4 · Confirm a transaction

4
The PIN is checked by Keycloak, server-side. Three wrong tries lock it for 15 minutes — after which the right PIN is refused too.

Debug log — browser side

Server-side logs are richer still: docker compose logs -f backend keycloak