Auth Architecture

core.auth is the centralized identity provider for the UNVRSL ecosystem. This section covers the complete auth design — account model, session mechanics, token architecture, security, and cross-app identity.

> Architectural rule (2026-07-19): All app → core.auth API calls are routed through core.console (https://core.console.medkronos.com/v1/auth/*) with the project API key. core.console validates the key, checks security rules, logs the request, relays to core.auth. The browser-facing pages (login, register, authorize, account dashboard) remain at core.auth.medkronos.com — these are federated UI, not project traffic. The core.auth.medkronos.com domain is never called from app backends.
>
> This reconciliation is in progress — some articles below still reference the older direct-communication model in code examples; the principle is the relay rule documented here, and the examples are being updated.

> Status: Design phase. The decisions below are finalized architecture; implementation is pending.

Articles

Core Architecture

• Account Model — Master accounts, identity data, data boundaries between core.auth and apps


• App Integration — How apps register, authenticate, and maintain linked users


• Session Architecture — JWT access tokens, stateful session validation, sticky sessions


• Scope Model — Three-tier scoping: simple, advanced, critical


• Token Mechanics — Custom JWT (HS256), session-based refresh, no refresh tokens


• Revocation & Security — Blacklist, IP logging, session revocation, anomaly detection


• SSO Flow — Cross-app login, navigation, service-to-service auth


• Database Schemas — Complete SQL DDL for all core.auth and app-side tables

Security & 2FA

• 2FA & Passkeys — TOTP, WebAuthn/passkeys, biometrics, recovery codes, enforcement policies


• Future Ideas — Cloud HSM, key rotation, medical data compliance, architecture scaling, feature ideas

User Flows

• Registration & Login — Email/password, Google/Apple OAuth, 2FA verification, connection tokens


• Frontend Architecture — Registration/login UI, account management dashboard, app authorization consent, User Circle (persistent account indicator + quick settings popover across all apps)


• QR Login & Multi-Device — Cross-device login via QR code, session management