OptionalblockedDomains refused outright (matched exactly or as a parent domain), whatever else is allowed.
OptionalconsumerREPLACES the built-in consumer-domain list when set (and non-empty).
OptionallinkMinutes an emailed link/code stays redeemable. Default 30, clamped to 1–1440.
OptionalmaxMost wrong code entries before the pending verification is voided. Default 5, clamped to 1–10.
OptionalmaxMost verification emails one session may trigger. Default 3, clamped to 1–20.
OptionalrequireRefuse consumer mailbox domains (see DEFAULT_CONSUMER_EMAIL_DOMAINS). Default false.
OptionalunverifiedSession duration cap while UNVERIFIED, in seconds. Stamped at mint as the session's absolute deadline. Absent ⇒ no cap from this layer.
OptionalverifiedSession duration cap once VERIFIED, in seconds (measured from the session's start). On verification the deadline is moved out to this — never pulled in. Absent ⇒ verification does not change the deadline.
The knobs of identity verification, in the shape an administrator authors them (JSON in the config cascade or
mj.config.cjs). Every field is optional; absent means "inherit the next layer".Members are camelCase on purpose: they ARE the JSON config keys (
mj.config.cjs,channels.config.IdentityVerification, and the snapshot stored on the session). Renaming one would rename a configuration key that deployments and stored sessions already use.