Single sign-on
SSO with Capnis applications
Use one capnis.one identity to access app.capnis.com, capnis.net, and other Capnis products.
For: All customers
1
How sign-in works
You on app.capnis.com capnis.one Back to app
| | |
|-- "Sign in with Capnis" ---->| |
| |-- Login (if needed) |
| |-- Consent screen |
|<-------- Redirect with authorization -----------------------|
|-- App creates your session |
- Click Sign in with Capnis on the external site
- Browser opens
https://capnis.one/oauth/authorize - Sign in to capnis.one if needed
- Review permissions and click Authorize
- Return to the application, signed in
2
Consent screen
You see the application name and requested scopes (permissions):
| Scope | Meaning |
|---|---|
openid | Basic identity |
profile | Your name |
email | Email address |
view-customer | Customer profile for apps |
sessions:read | Session info (some apps) |
Only authorize apps you trust
Click Deny if you do not recognize the application.
3
Sessions and tokens
- capnis.one session — keeps you signed in to the identity portal (up to ~90 days with stay signed in)
- App access token — about 1 hour per application
- Refresh token — up to 90 days unless you revoke the app
Revoke applications from Connected apps in the portal.
4
Capnis products
Technical details
OIDC discovery:
/.well-known/openid-configuration · Userinfo: /oauth/userinfo · Customer vs employee flows use subject_type on authorize.