Standards Conformance
Every Mezusphere environment with authentication enabled is a standards-based OpenID Connect provider. This page lists exactly what the platform implements, so a security architect can evaluate it without a discovery call.
Authorization and tokens
| Capability | Detail |
|---|---|
| Authorization flow | OAuth 2.1 authorization code flow. PKCE with the S256 challenge method is mandatory for every client, public and confidential |
| OpenID Connect provider | Per-environment discovery document at /.well-known/openid-configuration, with a per-environment JWKS endpoint |
| ID tokens | Signed with ES256 using per-environment keys |
| Issuer identification | RFC 9207 iss parameter on every authorization response |
| Refresh tokens | Rotated on every use. Replay of a consumed refresh token is detected and revokes the entire token chain |
| Session vs API lifetimes | Browser session and API token lifetimes are configured independently per environment |
| Sign-out | OIDC RP-Initiated Logout 1.0: end_session_endpoint with id_token_hint validation, a per-client post_logout_redirect_uri allowlist, session cookie clearing, and refresh-chain revocation |
Client management
| Capability | Detail |
|---|---|
| Client registry | Each environment manages its own OAuth clients, public and confidential, from the Console |
| Client metadata | Follows the RFC 7591 metadata model. Management is through the Console; there is no public dynamic-registration endpoint |
| Native apps | RFC 8252 callbacks: private-use URI schemes and loopback redirects (127.0.0.1 and [::1] with port wildcard) |
| Redirect URIs | Exact-match validation per client |
| Per-client enforcement | Allowed scopes, grant types, and response types are enforced per client |
| Confidential client secrets | Stored as bcrypt hashes; the plaintext is shown once at creation and on rotation |
Hosted endpoints
Each environment serves its own hosted authentication surface at its endpoint hostname: sign-in, sign-up, sign-out, authorization, token, silent refresh, password reset, email verification, and end-session, plus the discovery and JWKS documents. You build none of these pages and host none of these endpoints.
What this is not, yet
- External identity provider federation (social sign-in) is planned; today all identities live in per-environment user directories.
- Financial-grade API (FAPI) profiles are not in the core platform; the intended path is plugins.
- Enterprise SSO for Console operators (OIDC/SAML federation) is on the roadmap.
If a specification you rely on is not listed here, ask us at hello@mezusphere.com and you will get a precise answer.