User Auth Bridge Endpoints

These routes are private first-party bridge endpoints.

They are live on api.user.m7.org, but they are not general public auth APIs. Current intended caller:

  • sso.user.m7.org

Current live endpoints:

  • /auth/user/root-session
  • /auth/user/login
  • /auth/user/exchange
  • /auth/signup

Current Security Stance

All live routes in this family now require a first-party single-use dead-drop relay.

That relay is used as pipeline-origin proof for the SSO bridge.

Endpoint Summary

Route Typical caller What it does Notes
/auth/user/root-session sso.user.m7.org /process-login Mints root-session material from end-user credentials. Consumer browser-login bridge.
/auth/user/login sso.user.m7.org /device_login_process Mints end-user access and refresh material directly from credentials. Consumer device-approval bridge.
/auth/user/exchange sso.user.m7.org /token Exchanges user root-session or refresh material into OAuth token output. Consumer auth-code and refresh bridge.
/auth/signup sso.user.m7.org /process-signup Creates a user, bootstraps local email/profile state, and requests email confirmation delivery. Consumer signup bridge.

/auth/user/root-session

Purpose:

  • validate end-user credentials
  • mint root-session material for later OAuth-style exchange

Current request shape:

  • auth.user
  • auth.pass or auth.code
  • auth.client_id
  • relay.id
  • relay.key
  • optional fingerprint
  • optional dpop
  • optional htu

/auth/user/login

Purpose:

  • validate end-user credentials
  • mint access and refresh material for the consumer-user principal
  • apply relay-derived OAuth client context and token shaping

Current request shape:

  • auth.user
  • auth.pass or auth.code
  • relay.id
  • relay.key
  • optional fingerprint
  • optional scope
  • relay-derived client context and claim shaping

/auth/user/exchange

Purpose:

  • exchange user root-session or refresh material into OAuth token output
  • rebuild user claims for the resulting access token
  • forward DPoP, HTU, binding, and relay context downstream

Current request shape:

  • auth.token or token
  • auth.method
  • relay.id
  • relay.key
  • binding_chain
  • binding_link
  • optional fingerprint
  • optional dpop
  • optional htu

Important note:

  • the live route is /auth/user/exchange
  • this is the current replacement for the earlier consumer exchange naming that sat under the older session/client-auth split

/auth/signup

Purpose:

  • create a new end-user
  • attach email
  • create an initial profile row
  • request initial email-confirmation delivery through the local mail-service stub

Current request shape:

  • user
  • pass
  • confirm
  • email
  • client_id
  • relay.id
  • relay.key
  • optional displayname

Caller Guidance

  • do not integrate against these routes as if they were public login or public token endpoints
  • the supported public OAuth surface still lives on sso.user.m7.org
  • these routes should be treated as SSO backing APIs
1