4.1 Authentication & Security
4.1.1 OIDC Authentication (Standard OpenID Connect Flow)
MetaEdge supports the OIDC (OpenID Connect) standard authentication flow:
| Step | Endpoint | Description |
|---|---|---|
| Authorization | GET /oauth2/authorize | Validates client_id / redirect_uri, redirects (302) to the external authorization page |
| User Consent | POST /oauth2/authorize/consent | After the user logs in and consents, generates a one-time authorization code (stored in Redis) |
| Token Exchange | POST /oauth2/token | Exchanges authorization_code + PKCE code_verifier for a device_token |
| Internal Token → device_token | POST /oauth2/authorize (POST) | Exchanges an internal business-server access_token for a Meta Edge device_token |
- device_token: RS256-signed JWT containing standard OIDC claims.
- Verification public key:
GET /.well-known/jwks.json— returns an RSA public key JWK set, supporting key rotation. - OIDC Discovery:
GET /.well-known/openid-configuration— returns issuer, endpoint list, supported algorithms, and claims.
Additionally, traditional email + password login is supported:
POST /user/login-with-password— validates password, returns whether 2FA is required and a one-time login ticketPOST /user/login/2fa— second-factor verification (EMAIL / AUTHENTICATOR), issuesaccess_token+device_tokenon success