University of Sussex Single Sign-On (Okta tenant)
Sussex's Okta organization, reached on the Sussex-branded hostname okta.sussex.ac.uk, which CNAMEs to sussexac.customdomains.okta.com. It serves a complete OpenID Connect discovery document (issuer https://okta.sussex.ac.uk) advertising authorization code with PKCE, device code, CIBA, PAR, DPoP and dynamic client registration. The tenant is Sussex's; the contract is Okta's, so Okta's own generic API definition is deliberately not saved here. Access is limited to applications enrolled by the university and to @sussex.ac.uk credential holders.