---
title: "Security & Authentication Proxy"
description: "Restrict access to meinGPT-originated sessions and enforce secure identity forwarding"
canonical_url: "https://meingpt.com/en/docs/integrations/custom-ai-apps/security-auth-proxy"
language: en
---

# Security & Authentication Proxy

## Target model

Your app accepts only traffic coming through meinGPT and treats meinGPT as a trusted authentication proxy.

## Quick start

**Receive the token** - The JWT is passed in the URL hash:
```javascript
const token = new URLSearchParams(window.location.hash.slice(1)).get('token');
```

**Verify the token** - Validate signature and claims on your backend via JWKS.

**Handle expiry** - Tokens expire after 1 hour; refresh is done via `postMessage`.

## Required checks in your app

- Verify JWT signature via JWKS
- Validate `iss` against meinGPT
- Validate `aud` against expected `organizationId`
- Validate `exp`/`iat`
- Reject requests without a valid token

JWKS endpoint:

`https://app.meingpt.com/api/custom-apps/v1/jwks/{organizationId}`

## Relevant JWT claims

| Claim | Description |
|---|---|
| `iss` | always `https://app.meingpt.com` |
| `sub` | unique user ID |
| `aud` | organization ID |
| `exp` / `iat` | expiry and issued-at times |
| `email`, `username` | user identity |
| `role`, `teams` | role/team context for authorization |

For the cross-cutting platform pattern, see [JWT Identity Forwarding](/en/docs/integrations/jwt-identity-forwarding).

## Allow only meinGPT as embedding source

Set CSP for your frontend:

```http
Content-Security-Policy: frame-ancestors https://app.meingpt.com;
```

Optionally add additional allowed domains if your deployment requires them.

## Proxy pattern for third-party APIs

- Keep API keys server-side in your app
- Frontend calls only your backend endpoints
- Backend enforces permissions based on meinGPT JWT claims

This way, meinGPT acts as identity source and your backend as policy enforcer.

## Minimal middleware (Node/Express)

```javascript

const JWKS = jose.createRemoteJWKSet(
  new URL('https://app.meingpt.com/api/custom-apps/v1/jwks/<ORG_ID>')
);

export async function requireMeinGPTAuth(req, res, next) {
  try {
    const token = req.headers.authorization?.replace('Bearer ', '');
    if (!token) return res.status(401).json({ error: 'Missing token' });

const { payload } = await jose.jwtVerify(token, JWKS, {
  issuer: 'https://app.meingpt.com',
  audience: '<ORG_ID>',
});

    req.user = payload;
    next();
  } catch {
    res.status(401).json({ error: 'Invalid token' });
  }
}
```

## Related docs

- [Identity Forwarding](/en/docs/integrations/jwt-identity-forwarding)