PESU OAuth2

Privacy

How this unofficial authorization server handles credentials, consents, tokens, and account data. This is not legal advice.

Passwords: transient vs vault

When you sign in for identity-only access, your PESU Academy password is used only to authenticate with Academy and is then discarded. It is transient — we do not store it for that mode.

If you later grant an app delegated access, you consent to storing an encrypted copy of your password (and related Academy session material) in a credential vault so a first-party API can refresh Academy access on your behalf. Vault data is envelope-encrypted; third-party apps never receive your password.

Consents

We store which apps you allowed, which scopes and access mode you granted, and related redirect metadata so we can skip repeat consent when nothing has changed. You can revoke apps from Settings when that surface is available.

Tokens

Authorization codes, access tokens, ID tokens, and refresh tokens are issued for OIDC/OAuth clients. Refresh tokens rotate on use and expire on an absolute schedule. Revocation and account deletion invalidate outstanding grants.

Email

We may send transactional email (for example verification or security notices) when those flows are enabled. We do not sell email addresses or use them for marketing.

Retention and delete

Delete credentials removes vault material while identity consents may remain. Delete account tombstones your user, revokes grants and tokens, deletes vault data, and never reuses your subject identifier.

Unofficial disclaimer

This service is unofficial and not affiliated with PESU or PESU Academy. The project is open source (MIT) at https://github.com/pesu-dev/oauth2.