✦Spectra SDK Docs

Backend login verification

앱 Backend는 브라우저나 모바일 앱이 전달한 사용자 ID, 이메일, profile 값을 그대로 신뢰하지 않는다.

Spectra Auth SDK 로그인 뒤에는 Auth access token을 Platform에 다시 확인한 다음 앱 자체 session을 발급한다.

이 문서는 Modo Camp 같은 소비 프로젝트 backend가 Google/Apple 로그인 결과를 검증하는 공식 경로를 설명한다.

Status

Endpoint

GET https://auth.spectra.kr/platform/v1/auth/sessions/current
Authorization: Bearer <spectra-auth-access-token>

The bearer token is the default Auth session access token returned by the Auth JS SDK:

const spectraToken = await auth.getAccessToken();

Do not use service tokens for this endpoint.

await auth.getAccessToken({ service: "chat" });    // not for backend login verification
await auth.getAccessToken({ service: "storage" }); // not for backend login verification

Service tokens are scoped for Spectra service SDKs such as Chat and Storage. If a service token is sent to the login

verification endpoint, Auth rejects it with 403 AUTH_SESSION_SCOPE_FORBIDDEN.

Consumer backend flow

1. The browser/mobile app completes Google or Apple login through Auth JS SDK.

2. The app calls auth.getAccessToken() without a service option.

3. The app sends that token to its own backend.

4. The backend calls GET /platform/v1/auth/sessions/current with that token.

5. The backend checks project_id, public_client_id and environment against its expected configuration.

6. The backend maps app_user_id to its own user record or creates one according to the app policy.

7. The backend issues its own app session only if the Platform response is valid.

Fail closed on verification failure, timeout or 5xx: do not create a new app session.

Backend example

const response = await fetch("https://auth.spectra.kr/platform/v1/auth/sessions/current", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${spectraAuthAccessToken}`,
  },
});

if (!response.ok) {
  throw new Error("spectra_auth_verification_failed");
}

const body = await response.json();
const session = body.data;

if (session.project_id !== process.env.SPECTRA_PROJECT_ID) {
  throw new Error("spectra_project_mismatch");
}
if (session.public_client_id !== process.env.SPECTRA_PUBLIC_CLIENT_ID) {
  throw new Error("spectra_client_mismatch");
}
if (session.environment !== process.env.SPECTRA_ENVIRONMENT) {
  throw new Error("spectra_environment_mismatch");
}
if (session.session_status !== "active" || session.app_user_status !== "active") {
  throw new Error("spectra_session_inactive");
}

await issueMyAppSession({
  spectraAppUserId: session.app_user_id,
});

Use placeholders in logs and documentation. Never log the bearer token, refresh token, Secret Key or provider credential.

Success response

{
  "data": {
    "app_user_id": "00000000-0000-4000-8000-00000000c102",
    "project_id": "00000000-0000-4000-8000-00000000c101",
    "public_client_id": "app_public_client_current_session",
    "environment": "test",
    "session_id": "00000000-0000-4000-8000-00000000c103",
    "session_status": "active",
    "app_user_status": "active",
    "token_type": "Bearer",
    "token_id": "00000000-0000-4000-8000-00000000c104",
    "issued_at": "2040-01-02T03:04:05.000Z",
    "expires_at": "2040-01-02T03:19:05.000Z",
    "scopes": ["auth.session"],
    "audiences": ["auth"]
  }
}

The response does not include token material, Secret Key material, provider secrets, refresh tokens or ID tokens.

Email fields

This endpoint does not currently return email, email_verified or email_source.

The Auth SDK session snapshot can expose provider summary fields for UI use, but the backend login verification contract

is app_user_id-first. If the consuming app needs email as an account identifier, store and verify that mapping in the

app backend or wait for an explicit Auth field contract that includes source and verification status.

Error contract

HTTP · Code · Meaning

401 · AUTH_SESSION_TOKEN_MISSING · Authorization: Bearer token is missing.

401 · AUTH_SESSION_TOKEN_MALFORMED · The bearer token is not a parseable Auth JWT.

401 · AUTH_SESSION_TOKEN_EXPIRED · The bearer token has expired.

401 · AUTH_SESSION_TOKEN_INVALID · Signature, issuer, audience, claim or key validation failed.

401 · AUTH_SESSION_REVOKED · The session is missing, logged out, revoked or no longer active.

403 · AUTH_SESSION_SCOPE_FORBIDDEN · A service token or non-auth-session token was sent.

403 · AUTH_SESSION_CONTEXT_MISMATCH · Token claims do not match the current session row.

403 · APP_USER_INACTIVE · The app user is suspended or inactive.

404 · PROJECT_NOT_FOUND · The token references a Project that does not exist.

403 · PROJECT_FORBIDDEN · The Project is not allowed for the requested Auth operation.

403 · PUBLIC_CLIENT_MISMATCH · The public client does not belong to the Project/session context.

503 · AUTH_SESSION_VERIFICATION_UNAVAILABLE · Auth cannot complete verification due to an internal dependency or verifier outage.

Error responses include a safe request_id for support escalation.

{
  "error": {
    "code": "AUTH_SESSION_REVOKED",
    "message": "Auth session is not active.",
    "request_id": "req_placeholder"
  }
}

Security and caching

environment with its own expected environment.

must compare returned Project/client/environment values before issuing an app session.

Relation to service token verification

Spectra internal services such as Storage, Chat, Notification, Delivery and Call may verify service-scoped tokens by

checking service audience, scopes and Auth introspection. That is different from consumer app login verification.

For app login, use GET /platform/v1/auth/sessions/current with the default Auth session token from auth.getAccessToken().