SSO Overview

Campus One is an identity provider (IdP). Your app is the relying party (RP). When a student wants to sign in to your app, the request flows through Campus One, which authenticates the student and returns a verified identity to your app.

Supported protocols

Protocol	Status	Best for	Token format
OpenID Connect	✅ Available	New apps, mobile, SPAs	JWT (ID token + access token)
SAML 2.0	🚧 Planned	Enterprise and legacy systems	XML assertion
OAuth 2.0	🚧 Planned	API-only integrations	Bearer access token

[!NOTE] OpenID Connect is the only live protocol today — and it's what you want for virtually every new integration (it's built on OAuth 2.0, so plain OAuth flows work through the same endpoints). SAML 2.0 is planned for enterprise/legacy systems; until it ships, integrate over OIDC.

[!TIP] Campus One is the login experience — connected apps don't build their own login pages. A student who already has a Campus One session is signed into your app automatically, with no credential prompt. See Automatic & silent sign-in.

Choose between a high-level overview or the full architectural details of the OpenID Connect flow:

Below is the complete sequence diagram detailing how Campus One's OpenID Connect flow operates, including the user consent checks, PKCE code challenges, and token exchanges:

Loading diagram...

Here is a simplified, high-level summary of the sign-in journey:

Loading diagram...

Token lifecycle

Token	Lifetime	Purpose
Authorization code	10 minutes	One-time exchange for tokens
ID token	1 hour	Identifies the authenticated user
Access token	1 hour	Authorizes calls to `/userinfo`
Refresh token	7 days	Issued only when `offline_access` is requested

Tokens are signed with Campus One's rotating RSA key. Verify signatures using the public JWKS:

https://auth.campusone.com.ng/api/auth/jwks

User attribute mapping

Campus One includes user attributes in the id_token and at the /userinfo endpoint. Which attributes are present depends on the permissions granted for your app and the scopes you request.

{
  "iss": "https://auth.campusone.com.ng",
  "aud": "your-client-id",
  "sub": "user_abc123",
  "email": "256240001@nileuniversity.edu.ng",
  "email_verified": true,
  "name": "Aisha Mohammed",
  "role": "student",
  "roles": ["student", "mentor"],
  "student_id": "256240001",
  "study_level": "undergraduate",
  "level": 300,
  "faculty_id": "fac_eng",
  "department_id": "dept_cs",
  "exp": 1735689600,
  "iat": 1735686000
}

Discovery document

All endpoint URLs are published at:

https://auth.campusone.com.ng/api/auth/.well-known/openid-configuration

Most OIDC libraries can auto-configure from this URL.

Integration examples

End-to-end implementations for common stacks: