AWS LPU

Identity Platform

Developer Documentation

Integrate with AWS LPU SSO.

Connect your application to AWS LPU Identity Services and let users sign in using one AWS LPU account.

Protocol

OAuth 2.0 + OIDC

Authorization

Authorization Code + PKCE

Identity

OpenID Connect

Quick Start

Your application only needs to do four things.

01Register your application

02Send users to AWS LPU SSO

03Receive the login response

04Exchange the code for identity

Register your application

Example

ApplicationAWS LPU Mock Exams

Client IDsso_xxxxxxxxxxxxxxxxx

Redirect URLhttps://yourapp.com/auth/callback

Keep your client secret on your server. Never expose it in frontend code.

Send the user to AWS LPU SSO

Redirect the user to the authorization endpoint with your application details.

Example

https://sso.awslpu.in/authorize?client_id=YOUR_CLIENT_ID&redirect_uri=YOUR_REDIRECT_URI&response_type=code&scope=openid%20profile%20email&state=YOUR_STATE&nonce=YOUR_NONCE&code_challenge=YOUR_CHALLENGE&code_challenge_method=S256

client_id

The Client ID generated when you registered your application.

redirect_uri

Must exactly match a redirect URL registered for your application.

state

A random value created before login and verified after the user returns.

nonce + PKCE

Security values generated before sending the user to sign in.

Handle the callback

After the user signs in, AWS LPU SSO redirects them back to your registered redirect URL.

Example

https://yourapp.com/auth/callback?code=AUTHORIZATION_CODE&state=YOUR_STATE

Verify that the returned state matches the value created before login. Then use the authorization code to get the user's identity.

Exchange the authorization code

Send the authorization code to the token endpoint from your server.

Example

POST https://sso.awslpu.in/oauth/token

Authorization: Basic BASE64(CLIENT_ID:CLIENT_SECRET)
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=AUTHORIZATION_CODE
&redirect_uri=YOUR_REDIRECT_URI
&code_verifier=YOUR_CODE_VERIFIER

The response contains an access token and, when you request the openid scope, an ID token.

Example

{
  "access_token": "...",
  "token_type": "Bearer",
  "expires_in": 900,
  "scope": "openid profile email",
  "id_token": "..."
}

Get user information

Use the access token to get the authenticated user's information.

Example

GET https://sso.awslpu.in/oauth/userinfo

Authorization: Bearer ACCESS_TOKEN

Depending on the scopes requested, the user information can include their identity, name, email, and profile picture.

Example

{
  "sub": "user-id",
  "name": "User Name",
  "email": "user@example.com",
  "picture": "https://..."
}

Reference

AWS LPU SSO endpoints

Use these endpoints when integrating your application with AWS LPU Identity Services.

GEThttps://sso.awslpu.in/authorize

Starts the user sign-in and authorization process.

POSThttps://sso.awslpu.in/oauth/token

Exchanges an authorization code for access and identity tokens.

GEThttps://sso.awslpu.in/oauth/userinfo

Returns information about the authenticated user.

GEThttps://sso.awslpu.in/oauth/jwks

Provides public keys used to verify ID tokens.

GEThttps://sso.awslpu.in/.well-known/openid-configuration

Provides the complete OpenID Connect configuration.