Integration examples

Every example uses the auto sign-in flow: there is no login page and no "Sign in" button. Each app silently asks Campus One whether the visitor already has a session (prompt=none) and signs them in transparently when they do — anonymous visitors fall through to your public view, and strictly protected routes auto-redirect into Campus One. The mechanics are described once in Automatic & silent sign-in; each guide just wires it up for its stack.

Each guide assumes you have already:

1. Registered your app in the developer dashboard with protocol OIDC and added your redirect URL.
2. Copied your CAMPUS_ONE_CLIENT_ID, CAMPUS_ONE_CLIENT_SECRET, and CAMPUS_ONE_WEBHOOK_SECRET from the Sign-in and Webhooks tabs of the app drawer.

Pick the stack closest to yours:

All examples use the authorization code flow with PKCE (required by Campus One per OAuth 2.1) and verify the id_token against the JWKS endpoint.

Shared concepts

The examples reference the same three values throughout:

# .env (server-side only — never expose CLIENT_SECRET to the browser)
CAMPUS_ONE_CLIENT_ID=cmpfh63i30002...
CAMPUS_ONE_CLIENT_SECRET=9800abcd1f11d44e844450b...
CAMPUS_ONE_ISSUER=https://auth.campusone.com.ng
CAMPUS_ONE_DISCOVERY_URL=https://auth.campusone.com.ng/api/auth/.well-known/openid-configuration

The role claim is included on every id_token whenever the openid scope is granted. Use it for authorization on the relying-party side — you do not need to call /userinfo for basic role checks. Request the roles scope to receive the full array of every role assigned to the user.

Common pitfalls

• Never expose CAMPUS_ONE_CLIENT_SECRET to the browser. All token-exchange requests happen on your server. For pure SPAs that have no backend, use PKCE without a client secret — see the React Router example for one approach (proxy via a tiny Express backend).
• redirect_uri must match exactly. Including the trailing slash. Mismatches return invalid_redirect_uri from Campus One.
• PKCE is required. Disabling it returns invalid_request.
• Always verify iss, aud, and exp on the id_token. The examples use jose (Node/Browser), authlib (Python), and coreos/go-oidc (Go) which do this for you when configured correctly.