Integration checklist
Connect a Capnis-operated website to capnis.one as an OAuth client.
Request OAuth client
A Capnis operator registers your website in the admin portal with redirect URIs, allowed scopes, subject types (employee and/or customer), and PKCE requirements.
Implement authorization code + PKCE
Redirect users to /oauth/authorize with state, nonce (OIDC), and S256 code_challenge. Exchange the code server-side at /oauth/token.
Validate tokens
Use JWKS or introspection to validate access tokens. Request only scopes required for your Capnis website.
Configure logout
Register post_logout_redirect_uris and call /oauth/logout for RP-initiated sign-out across Capnis websites.
Optional: roles & webhooks
Enable role sync and signed webhooks when your site must react to token or role changes from capnis.one.
Verify in staging
Run through employee sign-in, consent, token refresh, and revoke from the user portal before production.