Identity Forwarding

With JWT Identity Forwarding, meinGPT passes a signed JWT to third-party systems so they can securely evaluate user context.

This pattern is currently used in two areas:

• Custom AI Apps (iframe)
• Custom MCP Servers (header forwarding)

How it works

1. meinGPT creates a signed JWT with user and organization claims
2. The token is forwarded to the target system
3. The target verifies the signature via the JWKS endpoint
4. It applies permissions/scopes based on token claims

Transport variants

• Custom AI Apps: Token in URL hash (#token=...)
• Custom MCP Servers: Token in X-meinGPT-JWT header

Claims (subset)

• sub
• email
• username
• aud
• organizationName
• role
• teams

Verification

Public keys are available per organization via JWKS:

https://app.meingpt.com/api/custom-apps/v1/jwks/{organizationId}

Related docs

• Security & Authentication Proxy
• Custom MCP Server