Security & Authentication Proxy

Target model

Your app accepts only traffic coming through meinGPT and treats meinGPT as a trusted authentication proxy.

Quick start

const token = new URLSearchParams(window.location.hash.slice(1)).get('token');

Required checks in your app

• Verify JWT signature via JWKS
• Validate iss against meinGPT
• Validate aud against expected organizationId
• Validate exp/iat
• Reject requests without a valid token

JWKS endpoint:

https://app.meingpt.com/api/custom-apps/v1/jwks/{organizationId}

Relevant JWT claims

Allow only meinGPT as embedding source

Set CSP for your frontend:

Content-Security-Policy: frame-ancestors https://app.meingpt.com;

Optionally add additional allowed domains if your deployment requires them.

Proxy pattern for third-party APIs

• Keep API keys server-side in your app
• Frontend calls only your backend endpoints
• Backend enforces permissions based on meinGPT JWT claims

This way, meinGPT acts as identity source and your backend as policy enforcer.

Minimal middleware (Node/Express)

import * as jose from 'jose';

const JWKS = jose.createRemoteJWKSet(
  new URL('https://app.meingpt.com/api/custom-apps/v1/jwks/<ORG_ID>')
);

export async function requireMeinGPTAuth(req, res, next) {
  try {
    const token = req.headers.authorization?.replace('Bearer ', '');
    if (!token) return res.status(401).json({ error: 'Missing token' });

    const { payload } = await jose.jwtVerify(token, JWKS, {
      issuer: 'https://app.meingpt.com',
      audience: '<ORG_ID>',
    });

    req.user = payload;
    next();
  } catch {
    res.status(401).json({ error: 'Invalid token' });
  }
}

Related docs

• Identity Forwarding