PESU OAuth2

FAQ

Short answers for developers and sign-in users. More detail lives in Docs and Privacy.

Is this an official PESU / PESU Academy product?

No. This is an unofficial community project. It is not owned or operated by PESU or PESU Academy. The code is open source (MIT) on GitHub.

Does "Sign in with PESU" store my password?

For identity-only Sign in with PESU, no — your password is checked with Academy and then discarded; nothing is written to the vault. If you approve delegated access, an encrypted credential vault entry may be created so a first-party API can refresh Academy access. Third-party apps never see your password either way.

What is Testing vs Production for apps?

Apps start in Testing (or pending production). Only the owner and allowlisted testers can complete sign-in until the app is published to Production. That gate protects real users while you integrate.

What is delegated access / the credential vault?

Delegated access is an optional consent mode beyond identity. With your approval, we store envelope-encrypted Academy credentials in a vault so an internal token-exchange path can obtain short-lived Academy sessions for a future first-party API — without returning your password to callers. Identity-only consents never create a vault row.

How is this different from pesu-auth?

This repository is a standalone OIDC authorization server (authorize, token, userinfo, hosted login/consent, portal). It does not replace or modify pesu-auth; that project remains separate. Integrations talk to this issuer's OAuth/OIDC endpoints instead.