Proven Auth
Log in with a credential, not a password
Replace usernames, passwords, and federated identity providers with cryptographically verified Verifiable Credentials. Proven Auth adds passwordless login to your existing Keycloak SSO, or deploys on its own, using tamper-evident credentials stored on the user’s device. No stolen passwords, no breached databases, no third-party dependency.
- Keycloak integration
- OIDC / SAML compatible
- Deploy in hours
- Part of Indicio Proven®
The problem
Passwords fail. Federation creates dependency.
Passwords are the #1 attack vector
Stolen credentials were involved in 88% of web-application attacks, and credential compromise is the top initial access vector for breaches (2025 Verizon DBIR). Passwords invite phishing, reuse, and brute force, and MFA adds friction without removing the underlying weakness.
“Login with Google” is someone else’s infrastructure
Federated identity providers simplify login but create dependency on third parties you don’t control. Their outages block your users, and a policy change is yours to absorb. Authentication becomes rented, not owned.
Credential databases are breach targets
Any system that stores login credentials is a target, and the more it accumulates the more attackers want it. Remove the credential database and you remove the asset they’re after.
How it works
From password to cryptographic proof in four steps
Proven Auth integrates with Keycloak, the most widely deployed open-source identity and access management platform, adding Verifiable Credential authentication as a native login method alongside your existing OIDC and SAML flows.
Issue credential
Issue a Verifiable Credential to an employee, customer, or partner. It is stored in their digital wallet on their mobile device.
User requests access
At the login screen, the user scans a QR code or taps a prompt, and their wallet presents the credential. No username, password, or OTP needed.
Cryptographic verification
Proven Auth checks the credential’s cryptographic signature, confirms the issuer is trusted, and validates that the data has not been altered.
Access granted
Keycloak creates the session and the user is authenticated. No credential data stored on the server. No password database to breach. No third-party call.
Keycloak integration
Drop into the world’s most widely deployed open-source IAM
Proven Auth ships as a Keycloak plugin. On an existing Keycloak deployment, adding Verifiable Credential authentication is a configuration change, not a development project. For a new deployment, Proven Auth ships a pre-configured instance with VC authentication ready to go, and your existing OIDC and SAML applications keep working without modification.
Existing Keycloak
Install the plugin, configure the credential type and trusted issuers, and VC login appears as a new authentication option alongside your existing methods.
New deployment
Proven Auth deploys a full Keycloak instance pre-configured for VC authentication, with OIDC and SAML support included. Connect your applications immediately.
Protocol compatibility
OIDC, SAML 2.0, OAuth 2.0, and LDAP. Every application that can authenticate via Keycloak can now authenticate via Verifiable Credentials, without code changes.
Multi-format credentials
Accept SD-JWT VC, W3C VC, AnonCreds, and mdoc credentials. Configure which credential types and issuers are trusted per application or per realm.
Built for
Authentication that scales from SMB to enterprise
Enterprise
Employee and contractor access
Issue verifiable credentials to employees and contractors, and authenticate across internal applications, partner systems, and cloud services without managing password databases or relying on federated providers. Revoke access when someone leaves.
Customer-facing
Customer login and account recovery
Customers authenticate with a credential on their phone instead of remembering passwords, and account recovery becomes re-verification of the credential they already hold. No security questions, no email reset loops, and nothing for an attacker to phish.
Government
Citizen access to public services
Citizens use government-issued digital credentials to access public services. Compatible with EUDI Wallet credentials, national ID programs, and mDL, so a single credential works across agencies without building centralized identity databases.
The payoff
What disappears
Remove passwords and federation, and the risks attached to them go with them.
Password databases
No credentials stored server-side. Nothing to breach, nothing to hash, nothing to rotate.
Third-party dependency
No reliance on Google, Microsoft, or any federated provider. Authentication is sovereign.
Phishing exposure
Credentials are cryptographically bound to the holder’s device, so there’s no shared secret to phish, intercept, or replay.
Reset workflows
No “forgot password” flows, no security questions, no email reset loops. The credential is always on the user’s device.
In their words
“After learning about the technology and learning about the complete suite of software and tools that Indicio offers, we’re excited to use Indicio Proven to make it easier for our members to transmit learning transcripts and reduce the complexities associated with verification of information and data related to their educational achievements.”
Jerry HennAssistant Executive Director, United School Administrators of Kansas
Go deeper
More on passwordless authentication
How verifiable credentials replace the password, and what that means for your identity stack.
Article
Why passwords are the weakest link — and how to remove them
The economics of credential theft, and what changes when there's no shared secret to steal.
Article
Adding verifiable credentials to Keycloak
How Proven Auth plugs into your existing SSO without ripping out your identity provider.
Article
Phishing-resistant login, explained
What "phishing-resistant" actually requires, and why credential-based auth clears the bar.
Questions & answers
Proven Auth, explained
What is Proven Auth?
Proven Auth is passwordless authentication built on verifiable credentials. Instead of logging in with a password or a federated social login, a user proves who they are by presenting a credential they hold, which the system checks cryptographically. There is no shared password to store, steal, or reset.
How is this different from a password or ordinary MFA?
A password is a shared secret: the user knows it and the service stores a version of it, and either side can be breached. Proven Auth replaces that secret with a credential the user holds and presents on demand. Because there is no shared secret sitting in a database and nothing for a user to type into a fake login page, the most common attack paths against passwords and one-time codes do not apply in the same way.
Does it work with Keycloak and our existing SSO?
Yes. Proven Auth is designed to plug into Keycloak and your existing identity provider rather than replace it. It fits alongside the single sign-on you already run, so you can add credential-based login to current applications without rebuilding your authentication stack.
What standards and protocols does it use?
It works with the standard authentication protocols your systems already speak, including OIDC and SAML, and it is built on open verifiable credential standards. That combination lets it slot into existing federation while adding credential-based proof as the login method.
Why is credential-based login considered phishing-resistant?
Phishing usually works by tricking someone into entering a secret on a page an attacker controls. With Proven Auth there is no reusable secret to enter, and the credential presentation is bound cryptographically rather than typed in, so a captured screen or a lookalike site does not hand an attacker something they can replay. It raises the bar against the phishing techniques that target passwords and shared codes.
What happens if a user loses their device?
Credential-based login includes recovery and re-issuance paths, so a lost or replaced device does not lock a user out permanently. The specifics depend on how you configure issuance and recovery for your deployment, which is something we work through with you during implementation.
Next step
Retire the password. Keep your stack.
See how Proven Auth adds verifiable-credential login to Keycloak and your existing SSO — and what it takes to pilot it with your team.
Phishing-resistant
No shared secret to steal, phish, or replay — authentication is cryptographic proof, not a password.
Works with what you have
Plugs into Keycloak and your current identity provider. No rip-and-replace.
User-held identity
Credentials live in the user's wallet, presented on demand — not stored in a breachable central database.
