The expected audience for tokens from this provider
OptionalclientOAuth client ID for this provider (used by OAuth proxy for upstream auth)
ProtectedconfigThe issuer URL for this provider (must match the 'iss' claim in tokens)
ProtectedjwksThe JWKS endpoint URL for retrieving signing keys
Unique name identifier for this provider
Extracts user identity from a MJ-issued magic-link JWT payload.
Gets the signing key for token verification with retry logic
Checks if a given issuer URL belongs to this provider
Validates that required configuration is present
Authentication provider for MemberJunction-issued magic-link session tokens.
Unlike Auth0/Okta/etc., the tokens this provider validates are minted by MJ itself (RS256) when an external user redeems a magic-link invite. MJ publishes its public key at a JWKS endpoint, and this provider is registered with that endpoint as its
jwksUri— so the standard issuer-driven JWT validation path in MJServer (context.ts) verifies these tokens with no special-casing.The minted tokens carry standard OIDC identity claims (
email,given_name,family_name) plus magic-link scope claims (mj_app_id,mj_role,mj_magic_link). Only the identity claims are needed here; scope is enforced at provisioning time and by the assigned restricted role, not re-derived on every request.