AuthBasics

MPO Version: 1.3.0

Defines the fundamental authentication configuration for the project. These settings determine the authentication method(s) used across all services, including token-based, SSO, remote service, or API key authentication.

interface AuthBasics = {
  JWTAuthentication : JWTAuth;
  ssoAuthentication : SSOAuth;
  apiKeyAuthentication : APIKeyAuth;
  httpSettings : AuthHttpSettings;
  cookieSettings : CookieSettings;
}

JWTAuth

MPO Version: 1.3.0

Defines the configuration for JWT-based authentication, where the project issues and verifies its own JSON Web Tokens. This is the recommended authentication method in Mindbricks due to its stateless nature and scalability.

interface JWTAuth = {
  useJWTForAuthentication : Boolean;
  configuration : JWTAuthConfig;
}

JWTAuthConfig

MPO Version: 1.3.0

Defines the configuration details for JWT-based authentication. This object is used when useJWTForAuthentication is set to true. It includes token and key refresh periods.

interface JWTAuthConfig = {
  tokenPeriodInDays : Integer;
  keyRefreshPeriodInDays : Integer;
}

SSOAuth

MPO Version: 1.3.0

Defines the Single Sign-On (SSO) configuration for the project. This allows users to authenticate via their organization's identity provider using standard SSO protocols. Mindbricks integrates with external SSO providers but does not generate or host its own SSO server.

interface SSOAuth = {
  useSSOForAuthentication : Boolean;
  configuration : SSOAuthConfig;
}

SSOAuthConfig

MPO Version: 1.3.0

Defines the configuration for an external SSO provider. This object is used when useSSOForAuthentication is set to true. It includes provider name, token period, endpoints, and profile mapping.

interface SSOAuthConfig = {
  ssoName : String;
  tokenPeriodInMinutes : Integer;
  emailPropertyInProfile : String;
  userNamePropertyInProfile : String;
  ssoUserIdPropertyInProfile : String;
  ssoServerSettings : SSOServerSettings;
}

SSOServerSettings

MPO Version: 1.3.0

The SSOServerSettings object defines the configuration for a Single Sign-On (SSO) integration, including endpoint URLs and client credentials. These settings enable the service to interact with an external identity provider using OAuth2/OIDC protocols by specifying how to authenticate, retrieve tokens, get user info, and handle logouts.

interface SSOServerSettings = {
  tokenHost : String;
  authPath : String;
  tokenPath : String;
  userInfoPath : String;
  logoutPath : String;
  redirectUrl : String;
  clientId : String;
  clientSecret : String;
}

APIKeyAuth

MPO Version: 1.3.0

Enables API key authentication for the project. When enabled, Mindbricks generates an apiKey data object, management APIs (create, list, delete), and validation endpoints. Secret API keys use the skmbx prefix and allow tokenless, session-based authentication — ideal for server-to-server integrations, AI agents, CI/CD pipelines, and MCP connections. Public API keys are defined in the configuration schema for future support but are not yet implemented.

interface APIKeyAuth = {
  useAPIKeyForAuthentication : Boolean;
  configuration : APIKeyAuthConfig;
}

APIKeyAuthConfig

MPO Version: 1.3.0

Fine-tune API key authentication behavior. Controls which key types are generated, where keys are located in requests, and custom header/query parameter names. When omitted, Mindbricks defaults to secret-only keys in the Authorization Bearer header with the skmbx prefix — no additional configuration needed for standard usage. Note: public API key fields (publicApiKeyLocation, publicApiKeyName) are reserved for future support and have no effect currently.

interface APIKeyAuthConfig = {
  apiKeyType : APIKeyType;
  secretApiKeyLocation : RequestLocations;
  publicApiKeyLocation : RequestLocations;
  secretApiKeyName : String;
  publicApiKeyName : String;
}

APIKeyType

Specifies the type of API key to use. This can be either 'secret', 'public', or 'both'. If not set, the default is 'secret'. If you need to use both secret and public keys, you can set this to 'both'.

const APIKeyType = {
  secret: "secret",
  public: "public",
  both: "both",
};

RequestLocations

An enum type to refer to a specific section of an HTTP request where data (e.g., tokens or parameters) can be located.

const RequestLocations = {
  bearer: "bearer",
  cookie: "cookie",
  header: "header",
  query: "query",
  body: "body",
  urlpath: "urlpath",
  session: "session",
  request: "request",
};

AuthHttpSettings

MPO Version: 1.3.0

Defines the HTTP configuration of the auth service. Primarily includes the port on which the auth service will accept HTTP requests.

interface AuthHttpSettings = {
  httpPort : Integer;
  routerSuffix : String;
}

CookieSettings

MPO Version: 1.3.0

Use this settings to arrange the allowed domains of your applications cookie. Note thar a mindbricks service cookie is set as secure:true, httpOnly:true, sameSite:none, but domain is set according to the login requesrt hos if it is in. the allowed list or defaults.

interface CookieSettings = {
  allowedDomains : String[];
}