This page captures operator notes for common actions being done within the Keycloak service. Unless stated, all of these must be done from an Operator's login.
How to send the onboarding email (admin console):
The user gets one email with a link. Clicking it walks them through each action in sequence, and the email counts as verified because they clicked a link sent to that address.
The system does not automatically redirect a user to an app using the steps above. So, if you really want that great experience,
# get access token
KC=https://auth.example.com
REALM=myrealm
TOKEN=$(curl -s -X POST "$KC/realms/master/protocol/openid-connect/token" \
-d grant_type=password \
-d client_id=admin-cli \
-d username=admin \
-d 'password=YOUR_ADMIN_PASSWORD' | jq -r .access_token)
# lookup the user
USER_ID=$(curl -s -H "Authorization: Bearer $TOKEN" \
"$KC/admin/realms/$REALM/users?email=brandon@rachelski.net&exact=true" | jq -r '.[0].id')
# send the user the credential set email
curl -s -X PUT \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
"$KC/admin/realms/$REALM/users/$USER_ID/execute-actions-email?client_id=my-app&redirect_uri=https%3A%2F%2Fwww.example.com%2F&lifespan=86400" \
-d '["UPDATE_PASSWORD","CONFIGURE_TOTP","webauthn-register","VERIFY_EMAIL"]' \
-w '%{http_code}\n'