Skip to main content

Educational Institute OAuth and AAA Setup

Educational institutes can choose either WispHive-hosted OAuth entry or AAA handoff mode.

When to choose hosted OAuth​

Choose this when the institution wants a WispHive-managed auth entry URL but still uses Google, Microsoft, Auth0, or another OIDC provider for actual identity verification.

When to choose AAA handoff​

Choose this when the institution already has a campus identity portal and only needs to hand verified users back to WispHive.

Institution-specific validation​

Education registrations already enforce an academic email during onboarding. For AAA handoff integrations, the registration must be of type education; other registration types are rejected.

Institution clients should include at least:

  • entity_name
  • userid
  • derived_username
  • derived_email
  • user_session_id

The derived values should not reveal raw personally identifiable information. They exist only to support session correlation and redirect orchestration. WispHive assigns each institution a derived namespace and derived email domain that your backend must use when posting AAA handoff callbacks.