Internal SSO for Capnis
Capnis.one is our private authorization server for Capnis employees and approved internal applications. Access is managed by Capnis operators—not open public registration.
What this service is for
A single sign-on layer behind the firewall of our organization—built for staff and systems we operate, not for the general public.
Employee sign-in
Capnis staff authenticate here with corporate credentials, MFA, or passkeys before accessing internal tools.
Approved internal apps
Only OAuth clients registered by Capnis operators can request tokens. Each internal application is explicitly allow-listed.
Operator control
Admins manage clients, scopes, subject types, security policies, and audit logs from the Capnis admin panel.
From internal app to signed-in employee
Standard OAuth 2.0 authorization code flow with PKCE—used only by Capnis-operated applications registered on this server.
[Internal Capnis app] [capnis.one] [Internal Capnis app]
| | |
|-- GET /oauth/authorize ----->| |
| (client_id, scope, | |
| redirect_uri, PKCE) | |
| |-- Employee sign-in |
|<-- redirect + code ----------| (+ MFA if required) |
| | |
|-- POST /oauth/token ------------------------------------>|
|<-- access_token, refresh --------------------------------|
An internal application sends the browser to the authorize endpoint with its registered client_id, redirect_uri, requested scopes, and optional PKCE challenge.
The employee signs in with their Capnis account. MFA or passkey requirements apply per security policy before tokens are issued.
After successful authentication (and consent when scopes change), capnis.one redirects back to the internal app with a one-time authorization code.
The application exchanges the code server-side for access and refresh tokens, then validates JWTs via JWKS or introspection for API calls.
Who interacts with internal SSO
Three parties—none of which involve public self-service signup on this site.
Capnis employees
Staff members who sign in to access ERP, admin tools, and other internal Capnis systems through one identity profile.
Internal applications
Capnis-built or operator-approved apps that register as OAuth clients and receive tokens only for allowed employees and scopes.
Platform operators
Authorized admins who register OAuth sites, enforce MFA, review audit logs, and revoke access when needed.
What capnis.one is not
- Not a public identity provider for external customers or partners unless explicitly provisioned by Capnis operations.
- Not a self-service signup portal—employee accounts are created and managed through internal HR or admin processes.
- Not a marketplace of third-party OAuth clients; every client is registered and reviewed by Capnis operators.
Standards we use internally
Capnis staff: sign in here
Use your employee account to access internal Capnis applications. Need operator access? Contact the platform team.