The M7 Federation: Identity First, Services You Can Point At
M7 is a hybrid operation: source-available tools, federated platform services, hosted product surfaces, and contracting. That only works if the trust and service map is explicit.
This post is the operator-facing map.
Foundation order
id.m7 → root identity, credentials, grants, crypto-facing account ops
user ↓
user.m7 → human/org binding, roles, clients, groups, SSO / OAuth surfaces
↓
capability APIs → drop, bigfs, document, mail, post, developer, …
↓
product shells → www, user, developer, news, tilemap, …
Platform foundation first, tools around it is not a slogan. Identity is not bolted on after the UI.
Trust root: id.m7
id.m7 establishes the root identity layer: UUIDs, credentials, validation/signing surfaces, key rotation paths, grants, and session exchange used by downstream services.
API consumers on the federation typically validate M7 tokens with:
- Issuer:
id.m7.org - Algorithm family in current docs: RS512
- Principal classes: e.g. user / admin / root (service-dependent)
Soft vs hard token checks vary by service config. Treat issuer and principal rules as part of your integration contract.
People and apps: user.m7
user.m7.org binds identity to users and organizations.
Capabilities in the live API surface include (high level):
| Area | Examples |
|---|---|
| Account | profile, password, multi-email bind |
| Organizations | create/update/archive, identity attach |
| Groups | org-scoped membership tiers |
| Clients | application client registry inside orgs |
| OAuth | clients, connections, device code, client-credentials, offline access |
| SSO | sso.user.m7.org OIDC/OAuth-compatible public surface (see docs for current differences) |
Orgs are top-level containers: isolated member pools, group tiers (e.g. general vs premium), multi-brand separation without cross-org leakage unless you enroll it.
Capability services (federation peers)
The developer portal indexes sibling APIs. Representative family (endpoint counts move as services grow):
| Service | Role |
|---|---|
| api.user.m7.org | Account, org, OAuth, session-facing user plane |
| api.drop.m7.org | Dead drops — reserve, store, activate, consume, revoke |
| api.bigfs.m7.org | Large object/file plane — buckets, assets, vault, download issue/pull |
| api.document.m7.org | Document jobs, conversion, formats |
| api.mail.m7.org / api.post.m7.org | Outbound mail and post/job pipelines |
| api.developer.m7.org | Developer portal admin: assets, cache, config, docs pages, hooks |
| sso.user.m7.org | Browser SSO / OAuth public surface |
Shared product shells (including developer.m7.org and news.m7.org) boot with session context, API registry entries, and Active Tags-driven SPA navigation — same session framework, different site content.
Public vs private contracts
On api.user.m7.org, docs distinguish:
- Public — supported direct integration routes (still often require auth; public ≠ anonymous)
- Private — first-party bridge / relay / legacy handlers that are reachable but not a stable third-party integration surface
If you integrate, prefer documented public families. Do not build on private bridge routes unless you are M7 first-party.
Hosted vs standalone
M7 is intentionally hybrid:
| Mode | Meaning |
|---|---|
| Hosted / federated | Use M7-operated services under the shared trust model |
| Compatible peers | Build services that speak the same trust and principal model |
| Standalone tools | Active Tags, Siglatch, m7.js, map engines — run in your environment under MTL-10 / commercial terms |
You can adopt tools without adopting every hosted API. You can use identity and SSO without rewriting your whole product into a single vendor monorepo.
Licensing (short)
Core libraries and Siglatch ship under MTL-10: free for organizations with ≤10 users of the software as defined in the license; commercial licensing for larger teams, resale, or SaaS redistribution. See product repos and legal@m7.org.
Where to start
- www.m7.org — product overview
- user.m7.org — account / org plane
- developer.m7.org/docs — API and SDK sandbox
- This portal’s Lab feed — Active Tags and Siglatch production notes
— M7 Platform