SSO & authentication

Cross-app SSO

Magoven One is the identity hub. Suite apps (magMeet, magWork, magMail, magDocs, magDrive) trust One session cookies and short-lived JWTs.

Launch flow

1. User signs in at one.magoven.io/login 2. User clicks an app tile or visits /api/go/meet 3. One redirects with `sso` token containing orgId, licenses, policies 4. Target app validates token and creates local session

Session bridge

When a suite app session expires, it redirects to /api/auth/bridge?platform=mail&next=/inbox. One refreshes the session without re-prompting password.

Enterprise SAML / OIDC

Business plans configure identity providers under Settings → Enterprise → SSO.

SAML: Upload IdP metadata or enter SSO URL, entity ID, and certificate. ACS URL: `https://one.magoven.io/api/auth/sso/saml/acs`

OIDC: Client ID, secret, issuer URL. Callback: `https://one.magoven.io/api/auth/sso/oidc/callback`

SCIM provisioning

Enable SCIM in Enterprise settings. Provision users to One — licenses sync to suite apps automatically.

Security notes

- JWTs expire in minutes — apps must refresh via bridge - Product bridge secret must never ship to browsers - Require MFA for admin roles in production tenants