Overview

Welcome

MVS Auth is the canonical centralized authentication surface for the MVS estate. It consists of two Next.js apps backed by a shared Better Auth configuration package:

SurfacePublic hostWhat it serves
Central Authhttps://c-auth.mvscloud.comTenant user sign-in, self-service account management, and the OIDC Identity Provider (live in production)
Platform Authhttps://c2-auth.mvscloud.comMVS internal operator sign-in (Okta SSO, passkeys) and the operator OIDC provider consumed by operator apps. The cookie sign-in flow itself is a same-origin, redirect-based hosted site (shared .mvscloud.com cookie, no CORS); the OIDC endpoints are consumed cross-origin

API references

  • Central Auth API — every endpoint mounted at c-auth.mvscloud.com/api/auth, including sign-in/sign-up, sessions, two-factor, passkeys, organizations, SCIM, SSO, and the OIDC provider endpoints (/oauth2/*, /jwks).
  • Platform Auth API — the operator-facing endpoint family at c2-auth.mvscloud.com/api/platform-auth. The cookie sign-in flow is same-origin only (no CORS), but c2-auth is also a full operator OIDC provider whose /oauth2/* and JWKS endpoints are consumed cross-origin by operator apps — see the operator-app OIDC integration guide.
  • Service Routes — custom routes outside the Better Auth handler: OIDC discovery, signup/organization provisioning, cross-domain handoff, SSO helpers, mobile SSO, and health endpoints.

How these docs are produced

The Central and Platform API references are generated from the live Better Auth configuration (packages/auth-server/{central-auth,platform-auth}.ts) via:

$pnpm --filter @mvs/auth-server openapi:generate

Re-run after any plugin or config change and commit the updated fern/apis/*/openapi.json. The Service Routes spec is hand-maintained in fern/apis/auth-service/openapi.yml with a source-file citation on every operation.

Integrating a new application

Downstream applications authenticate against the OIDC Identity Provider. Start with OIDC relying-party integration. Every client is an oauth_client database row, written one of two supported ways: the gated, authenticated self-service registration API (admin session or scoped Initial Access Token — for internal MVS apps / CI), or the operator oidc:register CLI (the manual fallback). The only thing disabled is the RFC 7591 dynamic-registration plugin endpoint.