Everything you need to know.
Answers to common questions about security, privacy, and development.
Is this an official PESU / PESU Academy product?
No. This is an unofficial community project built by student developers. It is not owned, operated, or endorsed by PES University or PESU Academy. The code is entirely open source (MIT) on GitHub.
Does "Sign in with PESU" store my password?
For identity-only sign-ins, no — your password is verified against Academy and immediately discarded; nothing is stored in the credential vault. If you explicitly grant delegated access to an authorized client, an encrypted credential vault entry is created so an internal first-party API can refresh Academy sessions. Third-party applications never see your password either way.
What is Testing vs Production for apps?
All newly registered apps start in Testing (or pending production). Only the application owner and designated allowlisted testers can complete sign-in until the application is reviewed and published to Production by an administrator. This gate protects users during active development.
What is delegated access / the credential vault?
Delegated access is an optional consent mode beyond standard identity. With explicit approval, envelope-encrypted Academy credentials (AES-256-GCM) are stored in an isolated vault so an internal token-exchange path can obtain short-lived Academy sessions for first-party APIs on your behalf, without disclosing passwords. Standard identity consents never create a vault record.
How is this different from pesu-auth?
This repository is a standalone OpenID Connect authorization server providing standard OIDC flows (authorize, PKCE, token, userinfo, discovery, revocation, hosted login/consent, and developer portal). It does not replace or modify pesu-auth; that project remains independent. Campus applications integrate with this authorization server via standard OAuth 2.0 / OIDC protocol endpoints.