Skip to content
Synq
Multi-tenancy

Apps.
One per platform you ship on.

An App is the OIDC client your code identifies as. Every platform — web, SPA, native, backend, CLI — registers its own App under a Brand. Synq enforces the right rules for each type: PKCE for public clients, confidential secrets for the rest, exact-match redirect URIs everywhere.

The five App types

One App per platform you ship on

Why five and not one? Because OIDC clients have different security properties depending on where they run. Browsers can't keep a secret; servers can. CLIs can't pop a browser; native apps can. Treating them as separate Apps lets Synq enforce the right policy per type — and lets you revoke or rotate one without disturbing the rest.

Web

Confidential client

Server-rendered apps (Next.js, Rails, Django) with a client_secret kept on the server. Authorization code + PKCE + refresh token.

Example
app.acme.com (Next.js)

SPA

Public client

Browser-rendered single-page apps. PKCE mandatory; no client_secret. Refresh tokens issued only when offline_access is requested.

Example
dashboard.acme.com (Vite, CRA, Remix)

Native

Public client

iOS / Android / desktop apps using a deep-link redirect URI. PKCE mandatory. Tokens stored via secure-storage SDK adapters.

Example
acme://oauth/callback

M2M

Confidential client

Backends, workers, cron jobs, webhook receivers. Uses the client_credentials grant. No redirect URIs.

Example
acme-webhook-replayer

Agent

Public client

CLIs and AI agents using the OIDC device authorization grant (RFC 8628). The user authorizes on a phone or laptop; the agent polls until consent lands.

Example
acme-cli
What every App owns

Per-platform fields

client_id

Globally unique. Public-facing. Used to identify your App on every OIDC handshake.

client_secret (confidential clients only)

Encrypted at rest with AES-256-GCM. Shown once at creation; rotation is one Dashboard click with a grace window for in-flight exchanges.

Allowed grants

Pick from `authorization_code`, `refresh_token`, `client_credentials`, and the device-code grant. Synq enforces the list at the token endpoint.

Allowed scopes

A hard ceiling on what the App can request. Filters against the Brand’s scope catalog. Useful for sandboxing untrusted or partner clients.

Redirect URIs

Exact byte-match. Add one per environment (preview, prod). Synq rejects mismatches with a typed error.

Type-specific policy

Public clients must use PKCE (S256). Confidential clients can use either client_secret_basic or client_secret_post. M2M skips the user flow entirely. Agent apps must include the device-code grant.

Read more

The three-tier model

How Apps fit beneath Brands beneath Orgs, with a worked Aurora Media example.

Brands

The tier above Apps. Owns the provider mix, the scope catalog, and the theming Apps inherit.

OIDC issuer

The protocol Apps actually use. Discovery doc, JWKS, token endpoint, verification.

Common questions

Register your first App in two minutes.

Type, redirect URIs, allowed grants, allowed scopes. The Dashboard hands you the client_id (and the secret, if it’s confidential).

Request early accessTalk to sales