OpenID Connect.
A real issuer.

The spec is the contract

Auth platforms that ship a proprietary SDK as the primary API become a permanent dependency. If you want to leave, you have to rewrite every line of code that touched the SDK. Synq inverts that — the primary API is the OIDC spec, the SDKs are convenience wrappers. Your backend verifies a JWT the same way it would against any standards-compliant issuer. Replacing Synq would be a DNS change and a JWKS swap, not a rewrite.

Verify tokens from any backend

Synq tokens are RS256-signed JWTs. Any JWT library that fetches JWKS verifies them — no Synq SDK required server-side.

// Verify a Synq-issued access token from any backend, no SDK required.
import { jwtVerify, createRemoteJWKSet } from 'jose'

const JWKS = createRemoteJWKSet(
  new URL('https://api.synq.id/.well-known/jwks.json')
)

export async function verify(token: string) {
  const { payload } = await jwtVerify(token, JWKS, {
    issuer: 'https://api.synq.id',
    audience: process.env.SYNQ_BRAND_SLUG, // aud = brand.slug
  })
  return payload // { sub, aud, scope, iat, exp, azp, ... }
}

If your stack speaks OIDC, you're done

The setup story for OIDC is short — you point your existing OIDC client at Synq.

1. 1

   Register an App

   In the Dashboard, create an App under your Brand. Pick a type — Web, SPA, Native, or M2M. Synq issues a client ID (and a client secret for confidential clients).
2. 2

   Set redirect URIs

   Add one redirect URI per environment (preview, prod). Synq enforces exact byte-match, including the trailing slash if you have one.
3. 3

   Point your OIDC client at Synq

   Use any library that reads the OIDC discovery document. Set the issuer to https://api.synq.id and it will discover authorization, token, userinfo, and JWKS endpoints automatically.
4. 4

   Verify tokens server-side

   On any backend that speaks JWT, fetch JWKS from /.well-known/jwks.json, verify the signature, check the audience (your brand slug) and expiry. No Synq SDK required.
5. 5

   Use the SDKs only if you want the conveniences

   The @synqid SDKs add hooks, modals, theming, secure storage, and refresh-token plumbing. Skip them if you only need the standards — your auth keeps working either way.

How OIDC compliance compares

Every platform claims OIDC. The differences are in what the SDK adds on top — and how much of it your code depends on.

Pair it with

Common questions