Integrate Capnis websites
Operator-managed OAuth clients for Capnis websites—live OpenID discovery, standard endpoints, and OpenAPI export.
Live OpenID discovery
Could not load discovery document.
OIDC & OAuth endpoints
| Endpoint | Description |
|---|---|
GET /.well-known/openid-configuration | OpenID Connect discovery document |
GET /.well-known/jwks.json | JSON Web Key Set for token verification |
GET /oauth/authorize | Authorization endpoint (authorization code flow) |
POST /oauth/token | Token endpoint (code exchange, refresh) |
POST /oauth/introspect | Token introspection (RFC 7662-style) |
GET /oauth/userinfo | UserInfo claims (Bearer token, openid scope) |
GET|POST /oauth/logout | RP-initiated logout with registered post_logout_redirect_uris |
Integration steps
1. Register your Capnis website
Capnis operators create an OAuth site for your Capnis web property—redirect URIs, grant types, scopes, and subject types (customer and/or employee).
2. Implement authorization code + PKCE
Redirect users to capnis.one to sign in; store state; exchange the code server-side. Public clients should send code_challenge (S256).
3. Validate tokens
Use introspection or JWKS for JWT validation on your Capnis website. Request only the scopes you need.
4. Sync roles (optional)
Enable role sync on the OAuth site to push user updates from capnis.one or receive webhooks when roles change.
openid, profile, email, view-customer, and site-specific scopes are declared per OAuth client. Request the minimum set your Capnis website requires.
Send code_challenge and code_challenge_method=S256 on the authorize request, then code_verifier on the token exchange. Capnis can enforce PKCE per OAuth site.
Download the OpenAPI summary, follow the integration checklist, and use the ssoclient package for sample Capnis website integrations.
Need operator access?
OAuth site registration for Capnis websites is managed by Capnis administrators.