sso vw

docs/REFERENCE.md

@@ -1097,6 +1097,8 @@ storage:
 
 **TLS**: cert-manager auto-provisions Let's Encrypt certificate via `letsencrypt-prod` ClusterIssuer (same pattern as Gitea, Grafana, etc).
 
+**SSO**: Keycloak OIDC via `forte` realm (client ID: `vaultwarden`). Self-service client config Secret (`keycloak-client-vaultwarden`) triggers registrar to create KC client and sync credentials to `vaultwarden-oidc-credentials`. PKCE enabled.
+
 **Endpoints**:
 - Web UI: `https://bitwarden.forteapps.net`
 
@@ -1104,6 +1106,7 @@ storage:
 
 **Secrets**:
 - `prod-db-creds` (SealedSecret) — PostgreSQL credentials (`pgusername`, `pgpassword`) + SMTP credentials
+- `vaultwarden-oidc-credentials` (registrar-managed) — OIDC client ID + secret
 - `vaultwarden-tls` — auto-managed by cert-manager
 
 ### AI Code Review (ai-review)