Developer guide: single sign-on architecture

Short answer: PVology is an OpenID Connect client: authorization code with PKCE (S256), state and nonce, discovery checks, ID tokens signed with RS256, PS256 or ES256, exact issuer, audience and authorized party checks, and time checks with a 2-minute allowance. Test sign-in shows the claims without creating a session; member sign-in is switched on per organization after a joint test.

Verified for PVology 0.61.0 · updated 2026-10-11