Scopes & claims
Identity scopes, claim mapping, Testing gate, and redirect URI rules for Sign in with PESU.
Supported scopes (v1 identity)
Unknown scopes are dropped. After filtering, openid must still be present or authorize fails.
| Scope | Purpose |
|---|---|
| `openid` | Required. Sign-in; enables ID token |
| `profile` | Name and academic profile claims |
| `email` | Email address |
| `phone` | Phone number (sensitive) |
| `offline_access` | Refresh token / stay signed in |
Claims by scope
- Always: `sub`
- `profile`: `name`, `prn`, `srn`, `program`, `branch`, `semester`, `section`, `campus`
- `email`: `email`
- `phone`: `phone_number`
Testing vs Production
Apps start in Testing: only the developer and invited testers can complete login. After admin approval for Production, any PESU user can sign in.
Redirect URIs
redirect_uri on /authorize and /token must be an exact match to a URI registered for the client. No open redirects.
Out of public docs
/oauth/token-exchange is AS-internal only — not for third-party clients.