From 25b1d93e8cda49f89bfc6b49ee70a3ab19cdfac2 Mon Sep 17 00:00:00 2001
From: Piumal Rathnayake <piumal1999@gmail.com>
Date: Tue, 7 Jul 2026 11:16:19 +0530
Subject: [PATCH 1/3] Implement key manager config UI

---
 docs/rest-apis/devportal/key-managers.md                      | 2 --
 docs/rest-apis/devportal/schemas.md                           | 4 ----
 .../docs/administer/key-manager-integration.md                | 2 +-
 .../developer-portal/docs/devportal-openapi-spec-v0.9.yaml    | 4 ----
 .../src/controllers/viewConfigureController.js                | 2 +-
 portals/developer-portal/src/services/keyManagerService.js    | 2 +-
 6 files changed, 3 insertions(+), 13 deletions(-)

diff --git a/docs/rest-apis/devportal/key-managers.md b/docs/rest-apis/devportal/key-managers.md
index 06fc3ebc67..f271409305 100644
--- a/docs/rest-apis/devportal/key-managers.md
+++ b/docs/rest-apis/devportal/key-managers.md
@@ -276,11 +276,9 @@ Status Code **200**
 |---|---|
 |type|ASGARDEO|
 |type|WSO2IS|
-|type|KEYCLOAK|
 |type|GENERIC_OIDC|
 |type|ASGARDEO|
 |type|WSO2IS|
-|type|KEYCLOAK|
 |type|GENERIC_OIDC|
 
 ## Get a key manager
diff --git a/docs/rest-apis/devportal/schemas.md b/docs/rest-apis/devportal/schemas.md
index 73b0963d96..327e6c2d1d 100644
--- a/docs/rest-apis/devportal/schemas.md
+++ b/docs/rest-apis/devportal/schemas.md
@@ -1417,7 +1417,6 @@ API key response returned by generate/regenerate only. Unlike ApiKeyMetadataResp
 |---|---|
 |type|ASGARDEO|
 |type|WSO2IS|
-|type|KEYCLOAK|
 |type|GENERIC_OIDC|
 
 <h2 id="tocS_KeyManagerUpdateRequest">KeyManagerUpdateRequest</h2>
@@ -1456,7 +1455,6 @@ Partial update payload for a key manager. All fields are optional; only supplied
 |---|---|
 |type|ASGARDEO|
 |type|WSO2IS|
-|type|KEYCLOAK|
 |type|GENERIC_OIDC|
 
 <h2 id="tocS_KeyManagerResponseSchema">KeyManagerResponseSchema</h2>
@@ -1505,7 +1503,6 @@ Key manager configuration.
 |---|---|
 |type|ASGARDEO|
 |type|WSO2IS|
-|type|KEYCLOAK|
 |type|GENERIC_OIDC|
 
 <h2 id="tocS_KeyManagerPublicResponseSchema">KeyManagerPublicResponseSchema</h2>
@@ -1542,7 +1539,6 @@ Minimal developer-facing key manager view.
 |---|---|
 |type|ASGARDEO|
 |type|WSO2IS|
-|type|KEYCLOAK|
 |type|GENERIC_OIDC|
 
 <h2 id="tocS_WebhookSubscriberRequest">WebhookSubscriberRequest</h2>
diff --git a/portals/developer-portal/docs/administer/key-manager-integration.md b/portals/developer-portal/docs/administer/key-manager-integration.md
index 1c144c3bb7..7afab6abc6 100644
--- a/portals/developer-portal/docs/administer/key-manager-integration.md
+++ b/portals/developer-portal/docs/administer/key-manager-integration.md
@@ -39,7 +39,7 @@ curl -k -X POST https://localhost:3000/api/v0.9/key-managers \
 | Field | Required | Description |
 |---|---|---|
 | `metadata.name` | Yes | Unique display name shown to developers |
-| `spec.type` | Yes | Key manager type: `ASGARDEO`, `WSO2IS`, `KEYCLOAK`, or `GENERIC_OIDC` |
+| `spec.type` | Yes | Key manager type: `ASGARDEO`, `WSO2IS`, or `GENERIC_OIDC` |
 | `spec.tokenEndpoint` | Yes | OAuth2 token endpoint. The portal proxies `client_credentials` token requests here using the client ID/secret the developer supplies |
 | `spec.enabled` | No | Whether the key manager is active. Defaults to `true` |
 
diff --git a/portals/developer-portal/docs/devportal-openapi-spec-v0.9.yaml b/portals/developer-portal/docs/devportal-openapi-spec-v0.9.yaml
index 6d110685d5..fc9f610aa6 100644
--- a/portals/developer-portal/docs/devportal-openapi-spec-v0.9.yaml
+++ b/portals/developer-portal/docs/devportal-openapi-spec-v0.9.yaml
@@ -5048,7 +5048,6 @@ components:
           enum:
             - ASGARDEO
             - WSO2IS
-            - KEYCLOAK
             - GENERIC_OIDC
           example: ASGARDEO
         enabled:
@@ -5081,7 +5080,6 @@ components:
           enum:
             - ASGARDEO
             - WSO2IS
-            - KEYCLOAK
             - GENERIC_OIDC
           example: ASGARDEO
         enabled:
@@ -5112,7 +5110,6 @@ components:
           enum:
             - ASGARDEO
             - WSO2IS
-            - KEYCLOAK
             - GENERIC_OIDC
           example: ASGARDEO
         enabled:
@@ -5157,7 +5154,6 @@ components:
           enum:
             - ASGARDEO
             - WSO2IS
-            - KEYCLOAK
             - GENERIC_OIDC
           example: ASGARDEO
         tokenEndpoint:
diff --git a/portals/developer-portal/src/controllers/viewConfigureController.js b/portals/developer-portal/src/controllers/viewConfigureController.js
index 04d598aed5..039b0b6bc2 100644
--- a/portals/developer-portal/src/controllers/viewConfigureController.js
+++ b/portals/developer-portal/src/controllers/viewConfigureController.js
@@ -130,7 +130,7 @@ const loadViewSettingsPage = async (req, res) => {
             logger.warn('Failed to load key managers for settings page', { error: err.message });
         }
         templateContent.keyManagers = keyManagers;
-        templateContent.keyManagerTypes = ['ASGARDEO', 'WSO2IS', 'KEYCLOAK', 'GENERIC_OIDC'];
+        templateContent.keyManagerTypes = ['ASGARDEO', 'WSO2IS', 'GENERIC_OIDC'];
 
         const configAsset = await orgDao.getContent({
             orgId: orgId, fileType: constants.FILE_TYPE.LLMS_CONFIG, viewName, fileName: constants.FILE_NAME.LLMS_CONFIG
diff --git a/portals/developer-portal/src/services/keyManagerService.js b/portals/developer-portal/src/services/keyManagerService.js
index 1ab660cbbf..7bee2ce7b9 100644
--- a/portals/developer-portal/src/services/keyManagerService.js
+++ b/portals/developer-portal/src/services/keyManagerService.js
@@ -30,7 +30,7 @@ const { logUserAction } = require('../middlewares/auditLogger');
  * (a standard OAuth2 client_credentials request), so this list exists purely
  * to validate the `type` field when an admin configures a key manager.
  */
-const SUPPORTED_KM_TYPES = ['ASGARDEO', 'WSO2IS', 'KEYCLOAK', 'GENERIC_OIDC'];
+const SUPPORTED_KM_TYPES = ['ASGARDEO', 'WSO2IS', 'GENERIC_OIDC'];
 
 // ---------------------------------------------------------------------------
 // YAML ingestion helpers (mirrors parseIdentityProviderFromYamlFile pattern)

From fb716e174eacccd8d1d081c73eacc04f4437f106 Mon Sep 17 00:00:00 2001
From: Piumal Rathnayake <piumal1999@gmail.com>
Date: Sat, 11 Jul 2026 22:31:06 +0530
Subject: [PATCH 2/3] Update key manager types

---
 docs/rest-apis/devportal/key-managers.md      | 20 ++++--------
 docs/rest-apis/devportal/schemas.md           | 32 +++----------------
 .../administer/key-manager-integration.md     |  4 +--
 .../docs/devportal-openapi-spec-v0.9.yaml     | 30 ++++-------------
 .../key-managers/key-managers.spec.js         | 27 ++++++++--------
 .../applicationsContentController.js          |  1 -
 .../controllers/viewConfigureController.js    |  1 -
 .../partials/manage-keys-km-card.hbs          |  1 -
 .../application/partials/manage-keys.hbs      |  2 --
 .../src/pages/settings/page.hbs               | 23 +++----------
 .../src/services/keyManagerService.js         | 28 ++++++----------
 .../src/styles/manage-keys.css                |  6 ----
 12 files changed, 46 insertions(+), 129 deletions(-)

diff --git a/docs/rest-apis/devportal/key-managers.md b/docs/rest-apis/devportal/key-managers.md
index f271409305..cf6962245b 100644
--- a/docs/rest-apis/devportal/key-managers.md
+++ b/docs/rest-apis/devportal/key-managers.md
@@ -27,7 +27,6 @@ Creates a key manager configuration for the organization. If `id` is omitted, th
 {
   "displayName": "Asgardeo",
   "id": "asgardeo-prod",
-  "type": "ASGARDEO",
   "enabled": true,
   "tokenEndpoint": "https://api.asgardeo.io/t/myorg/oauth2/token"
 }
@@ -36,7 +35,6 @@ Creates a key manager configuration for the organization. If `id` is omitted, th
 ```yaml
 displayName: Asgardeo
 id: asgardeo-prod
-type: ASGARDEO
 enabled: true
 tokenEndpoint: https://api.asgardeo.io/t/myorg/oauth2/token
 
@@ -64,7 +62,7 @@ This operation requires <strong>Basic Auth</strong> authentication.
   "id": "asgardeo-prod",
   "displayName": "Asgardeo",
   "orgId": "org-12345",
-  "type": "ASGARDEO",
+  "type": "GENERIC_OIDC",
   "enabled": true,
   "tokenEndpoint": "https://api.asgardeo.io/t/myorg/oauth2/token",
   "createdBy": "alice@example.com",
@@ -194,7 +192,7 @@ This operation requires <strong>Basic Auth</strong> authentication.
       "id": "asgardeo-prod",
       "displayName": "Asgardeo",
       "orgId": "org-12345",
-      "type": "ASGARDEO",
+      "type": "GENERIC_OIDC",
       "enabled": true,
       "tokenEndpoint": "https://api.asgardeo.io/t/myorg/oauth2/token",
       "createdBy": "alice@example.com",
@@ -243,7 +241,7 @@ Status Code **200**
 |»»» id|string|false|none|The key manager's handle (unique per org). Not the internal database uuid.|
 |»»» displayName|string|false|none|none|
 |»»» orgId|string|false|none|none|
-|»»» type|string|false|none|none|
+|»»» type|string|false|read-only|Fixed at `GENERIC_OIDC` for every key manager. Not client-configurable.|
 |»»» enabled|boolean|false|none|none|
 |»»» tokenEndpoint|string(uri)|false|none|none|
 |»»» createdBy|string|false|none|Identity of the user who created this key manager, or `deleted_user` if that user's IDP reference no longer exists. Present on single-resource GET responses and list items.|
@@ -258,7 +256,7 @@ Status Code **200**
 |»» *anonymous*|[KeyManagerPublicResponseSchema](schemas.md#schemakeymanagerpublicresponseschema)|false|none|Minimal developer-facing key manager view.|
 |»»» id|string|false|none|The key manager's handle (unique per org). Not the internal database uuid.|
 |»»» displayName|string|false|none|none|
-|»»» type|string|false|none|none|
+|»»» type|string|false|read-only|Fixed at `GENERIC_OIDC` for every key manager.|
 |»»» tokenEndpoint|string(uri)|false|none|none|
 
 *continued*
@@ -274,11 +272,7 @@ Status Code **200**
 
 |Property|Value|
 |---|---|
-|type|ASGARDEO|
-|type|WSO2IS|
 |type|GENERIC_OIDC|
-|type|ASGARDEO|
-|type|WSO2IS|
 |type|GENERIC_OIDC|
 
 ## Get a key manager
@@ -322,7 +316,7 @@ This operation requires <strong>Basic Auth</strong> authentication.
   "id": "asgardeo-prod",
   "displayName": "Asgardeo",
   "orgId": "org-12345",
-  "type": "ASGARDEO",
+  "type": "GENERIC_OIDC",
   "enabled": true,
   "tokenEndpoint": "https://api.asgardeo.io/t/myorg/oauth2/token",
   "createdBy": "alice@example.com",
@@ -387,7 +381,6 @@ Updates an existing key manager configuration. Accepts either a `application/jso
 {
   "displayName": "Asgardeo",
   "id": "asgardeo-prod",
-  "type": "ASGARDEO",
   "enabled": true,
   "tokenEndpoint": "https://api.asgardeo.io/t/myorg/oauth2/token"
 }
@@ -396,7 +389,6 @@ Updates an existing key manager configuration. Accepts either a `application/jso
 ```yaml
 displayName: Asgardeo
 id: asgardeo-prod
-type: ASGARDEO
 enabled: true
 tokenEndpoint: https://api.asgardeo.io/t/myorg/oauth2/token
 
@@ -425,7 +417,7 @@ This operation requires <strong>Basic Auth</strong> authentication.
   "id": "asgardeo-prod",
   "displayName": "Asgardeo",
   "orgId": "org-12345",
-  "type": "ASGARDEO",
+  "type": "GENERIC_OIDC",
   "enabled": true,
   "tokenEndpoint": "https://api.asgardeo.io/t/myorg/oauth2/token",
   "createdBy": "alice@example.com",
diff --git a/docs/rest-apis/devportal/schemas.md b/docs/rest-apis/devportal/schemas.md
index 327e6c2d1d..9feea9b219 100644
--- a/docs/rest-apis/devportal/schemas.md
+++ b/docs/rest-apis/devportal/schemas.md
@@ -1394,7 +1394,6 @@ API key response returned by generate/regenerate only. Unlike ApiKeyMetadataResp
 {
   "displayName": "Asgardeo",
   "id": "asgardeo-prod",
-  "type": "ASGARDEO",
   "enabled": true,
   "tokenEndpoint": "https://api.asgardeo.io/t/myorg/oauth2/token"
 }
@@ -1407,18 +1406,9 @@ API key response returned by generate/regenerate only. Unlike ApiKeyMetadataResp
 |---|---|---|---|---|
 |displayName|string|true|none|none|
 |id|string|false|none|Desired handle for the key manager (unique per org), stored as-is. Optional — defaults to the key manager's `displayName` when omitted.|
-|type|string|true|none|none|
 |enabled|boolean|false|none|none|
 |tokenEndpoint|string(uri)|true|none|OAuth2 token endpoint. The OAuth application itself must be created directly in this key manager; the portal only proxies `client_appKeyMappings` token requests to this endpoint.|
 
-#### Enumerated Values
-
-|Property|Value|
-|---|---|
-|type|ASGARDEO|
-|type|WSO2IS|
-|type|GENERIC_OIDC|
-
 <h2 id="tocS_KeyManagerUpdateRequest">KeyManagerUpdateRequest</h2>
 
 <a id="schemakeymanagerupdaterequest"></a>
@@ -1430,7 +1420,6 @@ API key response returned by generate/regenerate only. Unlike ApiKeyMetadataResp
 {
   "displayName": "Asgardeo",
   "id": "asgardeo-prod",
-  "type": "ASGARDEO",
   "enabled": true,
   "tokenEndpoint": "https://api.asgardeo.io/t/myorg/oauth2/token"
 }
@@ -1445,18 +1434,9 @@ Partial update payload for a key manager. All fields are optional; only supplied
 |---|---|---|---|---|
 |displayName|string|false|none|none|
 |id|string|false|none|Desired handle for the key manager (unique per org), stored as-is.|
-|type|string|false|none|none|
 |enabled|boolean|false|none|none|
 |tokenEndpoint|string(uri)|false|none|none|
 
-#### Enumerated Values
-
-|Property|Value|
-|---|---|
-|type|ASGARDEO|
-|type|WSO2IS|
-|type|GENERIC_OIDC|
-
 <h2 id="tocS_KeyManagerResponseSchema">KeyManagerResponseSchema</h2>
 
 <a id="schemakeymanagerresponseschema"></a>
@@ -1469,7 +1449,7 @@ Partial update payload for a key manager. All fields are optional; only supplied
   "id": "asgardeo-prod",
   "displayName": "Asgardeo",
   "orgId": "org-12345",
-  "type": "ASGARDEO",
+  "type": "GENERIC_OIDC",
   "enabled": true,
   "tokenEndpoint": "https://api.asgardeo.io/t/myorg/oauth2/token",
   "createdBy": "alice@example.com",
@@ -1489,7 +1469,7 @@ Key manager configuration.
 |id|string|false|none|The key manager's handle (unique per org). Not the internal database uuid.|
 |displayName|string|false|none|none|
 |orgId|string|false|none|none|
-|type|string|false|none|none|
+|type|string|false|read-only|Fixed at `GENERIC_OIDC` for every key manager. Not client-configurable.|
 |enabled|boolean|false|none|none|
 |tokenEndpoint|string(uri)|false|none|none|
 |createdBy|string|false|none|Identity of the user who created this key manager, or `deleted_user` if that user's IDP reference no longer exists. Present on single-resource GET responses and list items.|
@@ -1501,8 +1481,6 @@ Key manager configuration.
 
 |Property|Value|
 |---|---|
-|type|ASGARDEO|
-|type|WSO2IS|
 |type|GENERIC_OIDC|
 
 <h2 id="tocS_KeyManagerPublicResponseSchema">KeyManagerPublicResponseSchema</h2>
@@ -1516,7 +1494,7 @@ Key manager configuration.
 {
   "id": "asgardeo-prod",
   "displayName": "Asgardeo",
-  "type": "ASGARDEO",
+  "type": "GENERIC_OIDC",
   "tokenEndpoint": "https://api.asgardeo.io/t/myorg/oauth2/token"
 }
 
@@ -1530,15 +1508,13 @@ Minimal developer-facing key manager view.
 |---|---|---|---|---|
 |id|string|false|none|The key manager's handle (unique per org). Not the internal database uuid.|
 |displayName|string|false|none|none|
-|type|string|false|none|none|
+|type|string|false|read-only|Fixed at `GENERIC_OIDC` for every key manager.|
 |tokenEndpoint|string(uri)|false|none|none|
 
 #### Enumerated Values
 
 |Property|Value|
 |---|---|
-|type|ASGARDEO|
-|type|WSO2IS|
 |type|GENERIC_OIDC|
 
 <h2 id="tocS_WebhookSubscriberRequest">WebhookSubscriberRequest</h2>
diff --git a/portals/developer-portal/docs/administer/key-manager-integration.md b/portals/developer-portal/docs/administer/key-manager-integration.md
index 7afab6abc6..2be1dcf1aa 100644
--- a/portals/developer-portal/docs/administer/key-manager-integration.md
+++ b/portals/developer-portal/docs/administer/key-manager-integration.md
@@ -25,7 +25,6 @@ metadata:
   name: Asgardeo
 
 spec:
-  type: ASGARDEO
   enabled: true
   tokenEndpoint: https://api.asgardeo.io/t/myorg/oauth2/token
 ```
@@ -39,10 +38,11 @@ curl -k -X POST https://localhost:3000/api/v0.9/key-managers \
 | Field | Required | Description |
 |---|---|---|
 | `metadata.name` | Yes | Unique display name shown to developers |
-| `spec.type` | Yes | Key manager type: `ASGARDEO`, `WSO2IS`, or `GENERIC_OIDC` |
 | `spec.tokenEndpoint` | Yes | OAuth2 token endpoint. The portal proxies `client_credentials` token requests here using the client ID/secret the developer supplies |
 | `spec.enabled` | No | Whether the key manager is active. Defaults to `true` |
 
+Every key manager is treated as a generic OAuth2 `client_credentials` provider — there is no `type` to configure.
+
 ## List Key Managers
 
 ```bash
diff --git a/portals/developer-portal/docs/devportal-openapi-spec-v0.9.yaml b/portals/developer-portal/docs/devportal-openapi-spec-v0.9.yaml
index fc9f610aa6..a954799783 100644
--- a/portals/developer-portal/docs/devportal-openapi-spec-v0.9.yaml
+++ b/portals/developer-portal/docs/devportal-openapi-spec-v0.9.yaml
@@ -2986,7 +2986,6 @@ components:
           example:
             displayName: Asgardeo
             id: asgardeo-prod
-            type: ASGARDEO
             enabled: true
             tokenEndpoint: https://api.asgardeo.io/t/myorg/oauth2/token
         multipart/form-data:
@@ -3874,7 +3873,7 @@ components:
               - id: asgardeo-prod
                 displayName: Asgardeo
                 orgId: org-12345
-                type: ASGARDEO
+                type: GENERIC_OIDC
                 enabled: true
                 tokenEndpoint: https://api.asgardeo.io/t/myorg/oauth2/token
                 createdBy: alice@example.com
@@ -5031,7 +5030,6 @@ components:
       type: object
       required:
         - displayName
-        - type
         - tokenEndpoint
       properties:
         displayName:
@@ -5043,13 +5041,6 @@ components:
             Desired handle for the key manager (unique per org), stored as-is. Optional — defaults to the key
             manager's `displayName` when omitted.
           example: asgardeo-prod
-        type:
-          type: string
-          enum:
-            - ASGARDEO
-            - WSO2IS
-            - GENERIC_OIDC
-          example: ASGARDEO
         enabled:
           type: boolean
           default: true
@@ -5075,13 +5066,6 @@ components:
           type: string
           description: Desired handle for the key manager (unique per org), stored as-is.
           example: asgardeo-prod
-        type:
-          type: string
-          enum:
-            - ASGARDEO
-            - WSO2IS
-            - GENERIC_OIDC
-          example: ASGARDEO
         enabled:
           type: boolean
           default: true
@@ -5107,11 +5091,11 @@ components:
           example: org-12345
         type:
           type: string
+          description: Fixed at `GENERIC_OIDC` for every key manager. Not client-configurable.
           enum:
-            - ASGARDEO
-            - WSO2IS
             - GENERIC_OIDC
-          example: ASGARDEO
+          readOnly: true
+          example: GENERIC_OIDC
         enabled:
           type: boolean
           example: true
@@ -5151,11 +5135,11 @@ components:
           example: Asgardeo
         type:
           type: string
+          description: Fixed at `GENERIC_OIDC` for every key manager.
           enum:
-            - ASGARDEO
-            - WSO2IS
             - GENERIC_OIDC
-          example: ASGARDEO
+          readOnly: true
+          example: GENERIC_OIDC
         tokenEndpoint:
           type: string
           format: uri
diff --git a/portals/developer-portal/it/rest-api/key-managers/key-managers.spec.js b/portals/developer-portal/it/rest-api/key-managers/key-managers.spec.js
index da99434e1c..11cbc871b1 100644
--- a/portals/developer-portal/it/rest-api/key-managers/key-managers.spec.js
+++ b/portals/developer-portal/it/rest-api/key-managers/key-managers.spec.js
@@ -16,8 +16,9 @@
 // under the License.
 // --------------------------------------------------------------------
 
-// POST/GET/PUT/DELETE /key-managers. type must be one of
-// ASGARDEO | WSO2IS | KEYCLOAK | GENERIC_OIDC (KeyManagerRequest schema).
+// POST/GET/PUT/DELETE /key-managers. Every key manager is a generic OAuth2
+// client_credentials OIDC provider (type is fixed server-side at GENERIC_OIDC
+// and is not client-configurable).
 // Body accepts YAML or JSON per the handler; keep the fixture JSON-only.
 // `admin` manages org-level integration config.
 
@@ -29,23 +30,22 @@ describe('key managers', () => {
         await client.login('admin');
     });
 
-    it('creates a key manager (type: ASGARDEO) with a token endpoint', async () => {
+    it('creates a key manager with a token endpoint', async () => {
         const id = uniqueHandle('km');
         const res = await client.as('admin').post('/key-managers', {
             id,
-            displayName: 'Test Asgardeo KM',
-            type: 'ASGARDEO',
+            displayName: 'Test KM',
             tokenEndpoint: 'https://asgardeo.example.invalid/oauth2/token',
         });
         expect(res.status).toBe(201);
         expect(res.body.id).toBe(id);
-        expect(res.body.type).toBe('ASGARDEO');
+        expect(res.body.type).toBe('GENERIC_OIDC');
     });
 
     it('retrieves a key manager', async () => {
         const id = uniqueHandle('km');
         await client.as('admin').post('/key-managers', {
-            id, displayName: 'Test KM', type: 'ASGARDEO', tokenEndpoint: 'https://asgardeo.example.invalid/oauth2/token',
+            id, displayName: 'Test KM', tokenEndpoint: 'https://asgardeo.example.invalid/oauth2/token',
         });
 
         const res = await client.as('admin').get(`/key-managers/${id}`);
@@ -56,7 +56,7 @@ describe('key managers', () => {
     it('updates a key manager', async () => {
         const id = uniqueHandle('km');
         await client.as('admin').post('/key-managers', {
-            id, displayName: 'Original KM', type: 'ASGARDEO', tokenEndpoint: 'https://asgardeo.example.invalid/oauth2/token',
+            id, displayName: 'Original KM', tokenEndpoint: 'https://asgardeo.example.invalid/oauth2/token',
         });
 
         const res = await client.as('admin').put(`/key-managers/${id}`, { displayName: 'Renamed KM' });
@@ -67,7 +67,7 @@ describe('key managers', () => {
     it('deletes a key manager', async () => {
         const id = uniqueHandle('km');
         await client.as('admin').post('/key-managers', {
-            id, displayName: 'To Delete', type: 'ASGARDEO', tokenEndpoint: 'https://asgardeo.example.invalid/oauth2/token',
+            id, displayName: 'To Delete', tokenEndpoint: 'https://asgardeo.example.invalid/oauth2/token',
         });
 
         const del = await client.as('admin').del(`/key-managers/${id}`);
@@ -80,7 +80,7 @@ describe('key managers', () => {
     it('lists key managers for an org', async () => {
         const id = uniqueHandle('km');
         await client.as('admin').post('/key-managers', {
-            id, displayName: 'Listed KM', type: 'ASGARDEO', tokenEndpoint: 'https://asgardeo.example.invalid/oauth2/token',
+            id, displayName: 'Listed KM', tokenEndpoint: 'https://asgardeo.example.invalid/oauth2/token',
         });
 
         const res = await client.as('admin').get('/key-managers');
@@ -88,13 +88,14 @@ describe('key managers', () => {
         expect(res.body.list.some((km) => km.id === id)).toBe(true);
     });
 
-    it('rejects an unsupported type value', async () => {
+    it('ignores a client-supplied type and forces GENERIC_OIDC', async () => {
         const res = await client.as('admin').post('/key-managers', {
             id: uniqueHandle('km'),
-            displayName: 'Bad Type KM',
+            displayName: 'Type Override KM',
             type: 'NOT_A_REAL_TYPE',
             tokenEndpoint: 'https://asgardeo.example.invalid/oauth2/token',
         });
-        expect(res.status).toBe(400);
+        expect(res.status).toBe(201);
+        expect(res.body.type).toBe('GENERIC_OIDC');
     });
 });
diff --git a/portals/developer-portal/src/controllers/applicationsContentController.js b/portals/developer-portal/src/controllers/applicationsContentController.js
index a6cca29daf..997fc144dd 100644
--- a/portals/developer-portal/src/controllers/applicationsContentController.js
+++ b/portals/developer-portal/src/controllers/applicationsContentController.js
@@ -112,7 +112,6 @@ const loadApplicationData = async (req, orgName, applicationHandle, viewName) =>
         for (const km of dbKeyManagers) {
             kMmetaData.push({
                 id: km.handle,
-                type: km.type,
                 enabled: true,
                 tokenEndpoint: km.token_endpoint,
             });
diff --git a/portals/developer-portal/src/controllers/viewConfigureController.js b/portals/developer-portal/src/controllers/viewConfigureController.js
index 039b0b6bc2..f2a07dbe95 100644
--- a/portals/developer-portal/src/controllers/viewConfigureController.js
+++ b/portals/developer-portal/src/controllers/viewConfigureController.js
@@ -130,7 +130,6 @@ const loadViewSettingsPage = async (req, res) => {
             logger.warn('Failed to load key managers for settings page', { error: err.message });
         }
         templateContent.keyManagers = keyManagers;
-        templateContent.keyManagerTypes = ['ASGARDEO', 'WSO2IS', 'GENERIC_OIDC'];
 
         const configAsset = await orgDao.getContent({
             orgId: orgId, fileType: constants.FILE_TYPE.LLMS_CONFIG, viewName, fileName: constants.FILE_NAME.LLMS_CONFIG
diff --git a/portals/developer-portal/src/pages/application/partials/manage-keys-km-card.hbs b/portals/developer-portal/src/pages/application/partials/manage-keys-km-card.hbs
index 697840b670..4e2777dbdd 100644
--- a/portals/developer-portal/src/pages/application/partials/manage-keys-km-card.hbs
+++ b/portals/developer-portal/src/pages/application/partials/manage-keys-km-card.hbs
@@ -7,7 +7,6 @@
         </div>
         <div class="mk-km-info">
             <span class="mk-km-name">{{kmName}}</span>
-            {{#if kmType}}<span class="mk-km-type">{{kmType}}</span>{{/if}}
         </div>
         <span class="mk-km-badge {{#if isSandbox}}mk-km-badge-sandbox{{/if}}">
             <span class="mk-km-badge-dot"></span> Active
diff --git a/portals/developer-portal/src/pages/application/partials/manage-keys.hbs b/portals/developer-portal/src/pages/application/partials/manage-keys.hbs
index a52b6e299b..7e3d63dcc8 100644
--- a/portals/developer-portal/src/pages/application/partials/manage-keys.hbs
+++ b/portals/developer-portal/src/pages/application/partials/manage-keys.hbs
@@ -47,7 +47,6 @@
             {{> manage-keys-km-card
                 kmName=../id
                 kmId=../id
-                kmType=../type
                 keyType="PRODUCTION"
                 keys=keys
                 tokenEndpoint=../tokenEndpoint
@@ -85,7 +84,6 @@
             {{> manage-keys-km-card
                 kmName=../id
                 kmId=../id
-                kmType=../type
                 keyType="SANDBOX"
                 keys=keys
                 tokenEndpoint=../tokenEndpoint
diff --git a/portals/developer-portal/src/pages/settings/page.hbs b/portals/developer-portal/src/pages/settings/page.hbs
index 9da8c0108a..fb5afa993e 100644
--- a/portals/developer-portal/src/pages/settings/page.hbs
+++ b/portals/developer-portal/src/pages/settings/page.hbs
@@ -565,7 +565,6 @@
             <thead>
               <tr>
                 <th>Display name</th>
-                <th>Type</th>
                 <th>Token endpoint</th>
                 <th>Status</th>
                 <th style="width:90px;"></th>
@@ -578,7 +577,6 @@
                   <button type="button" class="cfg-km-edit-btn" data-id="{{id}}"
                     style="border:none;background:none;padding:0;cursor:pointer;font-size:.875rem;font-weight:600;color:#1a2433;text-decoration:none;">{{displayName}}</button>
                 </td>
-                <td><span class="cfg-name-chip">{{type}}</span></td>
                 <td>
                   <span class="cfg-name-chip" title="{{tokenEndpoint}}"
                     style="display:inline-block;max-width:260px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;">{{tokenEndpoint}}</span>
@@ -608,7 +606,7 @@
               </tr>
               {{/keyManagers}}
               {{#unless keyManagers.length}}
-              <tr><td colspan="5" class="cfg-tbl-empty">No key managers yet. Add one to get started.</td></tr>
+              <tr><td colspan="4" class="cfg-tbl-empty">No key managers yet. Add one to get started.</td></tr>
               {{/unless}}
             </tbody>
           </table>
@@ -880,19 +878,9 @@
       <input type="text" id="km-handle" class="cfg-form-input cfg-form-input--mono" placeholder="asgardeo-prod" />
       <p class="cfg-field-hint">Lowercase identifier used internally.</p>
     </div>
-    <div class="cfg-form-grid" style="margin-bottom:16px;">
-      <div class="cfg-form-group">
-        <label for="km-type">Type <span class="required">*</span></label>
-        <select id="km-type" class="cfg-form-input">
-          {{#each keyManagerTypes}}
-          <option value="{{this}}">{{this}}</option>
-          {{/each}}
-        </select>
-      </div>
-      <div class="cfg-form-group">
-        <label for="km-token-endpoint">Token endpoint <span class="required">*</span></label>
-        <input type="text" id="km-token-endpoint" class="cfg-form-input cfg-form-input--mono" placeholder="https://api.asgardeo.io/t/myorg/oauth2/token" />
-      </div>
+    <div class="cfg-form-group" style="margin-bottom:16px;">
+      <label for="km-token-endpoint">Token endpoint <span class="required">*</span></label>
+      <input type="text" id="km-token-endpoint" class="cfg-form-input cfg-form-input--mono" placeholder="https://api.asgardeo.io/t/myorg/oauth2/token" />
     </div>
     <div class="cfg-form-group" style="margin-bottom:24px;">
       <label style="display:flex;align-items:center;gap:10px;font-size:.844rem;color:#1a2433;font-weight:500;cursor:pointer;">
@@ -2321,7 +2309,6 @@
     sv('km-display',        mode === 'edit' ? data.displayName    : '');
     sv('km-handle',         mode === 'edit' ? data.id             : '');
     sv('km-token-endpoint', mode === 'edit' ? data.tokenEndpoint  : '');
-    document.getElementById('km-type').value    = mode === 'edit' ? data.type : document.getElementById('km-type').options[0].value;
     document.getElementById('km-enabled').checked = mode === 'edit' ? !!data.enabled : true;
     document.getElementById('cfg-km-modal').style.display = 'flex';
     document.getElementById('km-display').focus();
@@ -2338,7 +2325,6 @@
   document.getElementById('cfg-km-modal-save').addEventListener('click', async function() {
     var displayName   = v('km-display');
     var handle        = v('km-handle');
-    var type          = v('km-type');
     var tokenEndpoint = v('km-token-endpoint');
     if (!displayName || !handle || !tokenEndpoint) { await showAlert('Display name, handle and token endpoint are required.', 'error'); return; }
 
@@ -2352,7 +2338,6 @@
     var body = {
       id: handle,
       displayName: displayName,
-      type: type,
       tokenEndpoint: tokenEndpoint,
       enabled: document.getElementById('km-enabled').checked,
     };
diff --git a/portals/developer-portal/src/services/keyManagerService.js b/portals/developer-portal/src/services/keyManagerService.js
index 7bee2ce7b9..09d76d157e 100644
--- a/portals/developer-portal/src/services/keyManagerService.js
+++ b/portals/developer-portal/src/services/keyManagerService.js
@@ -26,11 +26,11 @@ const logger = require('../config/logger');
 const { logUserAction } = require('../middlewares/auditLogger');
 
 /**
- * Supported key manager types. Every type proxies token requests identically
- * (a standard OAuth2 client_credentials request), so this list exists purely
- * to validate the `type` field when an admin configures a key manager.
+ * Every key manager is a standard OAuth2 client_credentials-based generic
+ * OIDC provider. The `type` column is retained on the model for backward
+ * compatibility but is no longer client-configurable.
  */
-const SUPPORTED_KM_TYPES = ['ASGARDEO', 'WSO2IS', 'GENERIC_OIDC'];
+const DEFAULT_KM_TYPE = 'GENERIC_OIDC';
 
 // ---------------------------------------------------------------------------
 // YAML ingestion helpers (mirrors parseIdentityProviderFromYamlFile pattern)
@@ -44,7 +44,7 @@ function mapYamlToKeyManager(yamlDoc) {
     return {
         handle: yamlDoc.metadata?.name || spec.name,
         displayName: spec.displayName || spec.name,
-        type: spec.type,
+        type: DEFAULT_KM_TYPE,
         enabled: spec.enabled !== undefined ? spec.enabled : true,
         tokenEndpoint: spec.tokenEndpoint,
     };
@@ -111,7 +111,7 @@ const generateHandle = (name) =>
 const HANDLE_PATTERN = /^[a-zA-Z0-9_-]+$/;
 
 function _validateRequiredFields(payload) {
-    const missing = ['displayName', 'type', 'tokenEndpoint']
+    const missing = ['displayName', 'tokenEndpoint']
         .filter(f => !payload[f]);
     if (missing.length) {
         return `Missing required fields: ${missing.join(', ')}`;
@@ -141,10 +141,6 @@ const createKeyManager = async (req, res) => {
         if (validationError) {
             return res.status(400).json({ error: validationError });
         }
-        const resolvedType = typeof payload.type === 'string' ? payload.type.toUpperCase() : undefined;
-        if (!SUPPORTED_KM_TYPES.includes(resolvedType)) {
-            return res.status(400).json({ error: `Unsupported key manager type '${payload.type}'. Must be one of: ${SUPPORTED_KM_TYPES.join(', ')}.` });
-        }
         const hadExplicitHandle = !!(payload.handle && payload.handle.trim());
         const resolvedHandle = hadExplicitHandle ? payload.handle.trim() : generateHandle(payload.displayName);
         if (hadExplicitHandle && !HANDLE_PATTERN.test(resolvedHandle)) {
@@ -152,7 +148,7 @@ const createKeyManager = async (req, res) => {
         }
 
         const userId = util.resolveActor(req);
-        const record = await kmDao.create(orgId, { ...payload, handle: resolvedHandle, type: resolvedType }, userId);
+        const record = await kmDao.create(orgId, { ...payload, handle: resolvedHandle, type: DEFAULT_KM_TYPE }, userId);
         logUserAction('KEY_MANAGER_CREATED', req, { orgId, kmId: record.uuid, resourceUuid: record.uuid, resourceType: 'key_manager' });
         let audit;
         try {
@@ -185,14 +181,8 @@ const updateKeyManager = async (req, res) => {
         const orgId = req.orgId;
         const { kmId: kmHandle } = req.params;
         const payload = _resolvePayload(req);
-
-        if (payload.type !== undefined) {
-            const resolvedType = typeof payload.type === 'string' ? payload.type.toUpperCase() : undefined;
-            if (!SUPPORTED_KM_TYPES.includes(resolvedType)) {
-                return res.status(400).json({ error: `Unsupported key manager type '${payload.type}'. Must be one of: ${SUPPORTED_KM_TYPES.join(', ')}.` });
-            }
-            payload.type = resolvedType;
-        }
+        // The key manager type is fixed at GENERIC_OIDC and is not client-configurable.
+        delete payload.type;
 
         const kmId = await kmDao.getIdByHandle(orgId, kmHandle);
         if (!kmId) {
diff --git a/portals/developer-portal/src/styles/manage-keys.css b/portals/developer-portal/src/styles/manage-keys.css
index d38b7524fc..6c08ad3da2 100644
--- a/portals/developer-portal/src/styles/manage-keys.css
+++ b/portals/developer-portal/src/styles/manage-keys.css
@@ -155,12 +155,6 @@
     color: var(--main-text-color);
 }
 
-.keys-section .mk-km-type {
-    font-size: 0.78rem;
-    color: var(--main-text-color);
-    opacity: 0.55;
-}
-
 .keys-section .mk-km-badge {
     display: inline-flex;
     align-items: center;

From b235d9d18d3de1836bbbc00961790d41d57ff793 Mon Sep 17 00:00:00 2001
From: Piumal Rathnayake <piumal1999@gmail.com>
Date: Sat, 11 Jul 2026 22:56:41 +0530
Subject: [PATCH 3/3] Improve key manager creation validation

---
 .../docs/administer/key-manager-integration.md              | 6 ++++--
 .../it/rest-api/key-managers/key-managers.spec.js           | 5 ++---
 portals/developer-portal/src/services/keyManagerService.js  | 2 +-
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/portals/developer-portal/docs/administer/key-manager-integration.md b/portals/developer-portal/docs/administer/key-manager-integration.md
index 2be1dcf1aa..7915cafba3 100644
--- a/portals/developer-portal/docs/administer/key-manager-integration.md
+++ b/portals/developer-portal/docs/administer/key-manager-integration.md
@@ -22,9 +22,10 @@ apiVersion: devportal.api-platform.wso2.com/v1alpha1
 kind: KeyManager
 
 metadata:
-  name: Asgardeo
+  name: asgardeo-prod
 
 spec:
+  displayName: Asgardeo
   enabled: true
   tokenEndpoint: https://api.asgardeo.io/t/myorg/oauth2/token
 ```
@@ -37,7 +38,8 @@ curl -k -X POST https://localhost:3000/api/v0.9/key-managers \
 
 | Field | Required | Description |
 |---|---|---|
-| `metadata.name` | Yes | Unique display name shown to developers |
+| `metadata.name` | Yes | Unique handle for the key manager (used internally, e.g. in route segments) |
+| `spec.displayName` | Yes | Display name shown to developers |
 | `spec.tokenEndpoint` | Yes | OAuth2 token endpoint. The portal proxies `client_credentials` token requests here using the client ID/secret the developer supplies |
 | `spec.enabled` | No | Whether the key manager is active. Defaults to `true` |
 
diff --git a/portals/developer-portal/it/rest-api/key-managers/key-managers.spec.js b/portals/developer-portal/it/rest-api/key-managers/key-managers.spec.js
index 11cbc871b1..ee07cc7b79 100644
--- a/portals/developer-portal/it/rest-api/key-managers/key-managers.spec.js
+++ b/portals/developer-portal/it/rest-api/key-managers/key-managers.spec.js
@@ -88,11 +88,10 @@ describe('key managers', () => {
         expect(res.body.list.some((km) => km.id === id)).toBe(true);
     });
 
-    it('ignores a client-supplied type and forces GENERIC_OIDC', async () => {
+    it('every created key manager is GENERIC_OIDC by default', async () => {
         const res = await client.as('admin').post('/key-managers', {
             id: uniqueHandle('km'),
-            displayName: 'Type Override KM',
-            type: 'NOT_A_REAL_TYPE',
+            displayName: 'Default Type KM',
             tokenEndpoint: 'https://asgardeo.example.invalid/oauth2/token',
         });
         expect(res.status).toBe(201);
diff --git a/portals/developer-portal/src/services/keyManagerService.js b/portals/developer-portal/src/services/keyManagerService.js
index 09d76d157e..f43d963524 100644
--- a/portals/developer-portal/src/services/keyManagerService.js
+++ b/portals/developer-portal/src/services/keyManagerService.js
@@ -143,7 +143,7 @@ const createKeyManager = async (req, res) => {
         }
         const hadExplicitHandle = !!(payload.handle && payload.handle.trim());
         const resolvedHandle = hadExplicitHandle ? payload.handle.trim() : generateHandle(payload.displayName);
-        if (hadExplicitHandle && !HANDLE_PATTERN.test(resolvedHandle)) {
+        if (!resolvedHandle || !HANDLE_PATTERN.test(resolvedHandle)) {
             return res.status(400).json({ error: "Invalid 'id'. Must contain only letters, numbers, underscores, and hyphens." });
         }