Quick start
Wire a confidential or public client to authorization code + PKCE S256.
1. Register a client
Create an app in the developer portal (when available) with redirect URIs and choose public (none) or confidential (client_secret_post) auth.
2. Discover the issuer
GET /.well-known/openid-configuration and use authorization_endpoint, token_endpoint, jwks_uri, and code_challenge_methods_supported (S256 only).
3. Authorize (PKCE S256)
- Generate code_verifier (43–128 chars) and code_challenge = BASE64URL(SHA256(verifier)).
- Redirect to GET /authorize with response_type=code, client_id, redirect_uri, scope (include openid), code_challenge, code_challenge_method=S256, optional state/nonce.
- User signs in with PESU Academy credentials on the hosted login page.
- Handle Testing gate errors if the user is not an allowed tester.
4. Exchange the code
POST /token with grant_type=authorization_code, code, redirect_uri, code_verifier, and client credentials as required. Receive access_token, id_token, and optionally refresh_token.
5. Call UserInfo (optional)
GET /userinfo with Authorization: Bearer <access_token>.
6. Refresh / revoke
- Refresh: POST /token with grant_type=refresh_token.
- Revoke: POST /revoke with the token when signing the user out.
Libraries
Works with standard OIDC clients (Auth.js, AppAuth, etc.) that support authorization code + PKCE S256. Do not call /oauth/token-exchange from third-party apps.