Member Auth Bridge Endpoints

These routes are private first-party bridge endpoints for org-scoped member auth.

They are live on api.user.m7.org, but they are not general public auth APIs. Current intended caller:

  • sso.user.m7.org

Current live endpoints:

  • /auth/member/root-session
  • /auth/member/login
  • /auth/member/exchange

Current Security Stance

All live routes in this family now require a first-party single-use dead-drop relay.

Endpoint Summary

Route Typical caller What it does Notes
/auth/member/root-session sso.user.m7.org /process-login Mints root-session material for a named member within an org. Org-member browser-login bridge.
/auth/member/login sso.user.m7.org /device_login_process Mints access and refresh material for an org-scoped member principal. Org-member device-approval bridge.
/auth/member/exchange sso.user.m7.org /token Exchanges member root-session or refresh material into OAuth tokens. Org-member auth-code and refresh bridge.

/auth/member/root-session

Purpose:

  • validate an org-scoped member identity
  • mint root-session material for later exchange

Current request shape:

  • auth.user
  • auth.org
  • auth.client_id
  • auth.pass or auth.code
  • relay.id
  • relay.key
  • optional fingerprint
  • optional dpop
  • optional htu

/auth/member/login

Purpose:

  • validate an org-scoped member identity
  • mint access and refresh material for that member
  • apply relay-derived OAuth client context and token shaping

Current request shape:

  • auth.user
  • auth.org
  • auth.pass or auth.code
  • relay.id
  • relay.key
  • optional fingerprint
  • optional scope
  • relay-derived client context and claim shaping

/auth/member/exchange

Purpose:

  • exchange member root-session or refresh material into OAuth token output
  • rebuild org, member, and group claims for the resulting access token
  • forward DPoP, HTU, binding, and relay context downstream

Current request shape:

  • auth.token or token
  • auth.method
  • relay.id
  • relay.key
  • binding_chain
  • binding_link
  • optional fingerprint
  • optional dpop
  • optional htu

Important note:

  • the live route is /auth/member/exchange
  • this is the active replacement for the earlier /client-auth/exchange path

Caller Guidance

  • do not treat these as public member login or token endpoints
  • the supported public OAuth flow still lives on sso.user.m7.org
  • these routes should be treated as SSO backing APIs for org-member auth
1