Orgs, Brands, Apps.
One platform, many surfaces.
Synq is built around a three-tier model: an Organization holds your account, Brands are the trust surfaces your users see, and Apps are the OIDC clients your code identifies as. A media holding company runs its streaming brand, its live-sports brand, and its studio brand as three Brands under one Org — and you can too, without a second contract or a second dashboard.
One Org, many Brands, many Apps
Most identity platforms collapse this into one or two tiers and force you to spin up a whole new account every time you launch a second product surface. Synq treats Brands as siblings under one account — same billing, same team, same audit log, but independently themed and independently configured.
Organization
Your developer entity. Holds billing, team members, roles, API keys, the audit log, and webhooks. One Synq account = one Organization. Everything else lives underneath.
Brand
The trust surface your end-users see. Logo, colors, copy, consent screen, sign-in providers, scopes, and emails — all scoped here. One Org can run as many Brands as it has product surfaces.
App
An OIDC client your code identifies as. Each platform (web, SPA, native, M2M, agent) registers its own App under a Brand. The App has the redirect URIs, allowed grants, allowed scopes, and (for confidential clients) a client secret.
How a multi-product company maps to Synq
Picture Aurora Media — a fictional holding company with three consumer surfaces. One organization, three brand identities, each with its own consent screen.
Every Brand has its own logo, colors, copy, consent screen, providers, credentials, and email sender. Aurora Stream users see Aurora Stream. Aurora Sport users see Aurora Sport. The Aurora Media finance team sees a single bill.
What lives on the Org vs the Brand vs the App.
| Feature | Org | Brand | App |
|---|---|---|---|
| Billing + plan tier | ✓ | · | · |
| Team members + roles | ✓ | · | · |
| Audit log | ✓ | · | · |
| Org-wide API keys | ✓ | · | · |
| Webhooks (org-wide) | ✓ | · | · |
| Logo, colors, copy | · | ✓ | · |
| BYO OAuth credentials per provider | · | ✓ | · |
| Custom OIDC scopes | · | ✓ | · |
| Email sender + templates | · | ✓ | · |
| OIDC client_id + secret | · | · | ✓ |
| Redirect URIs | · | · | ✓ |
| Allowed grants | · | · | ✓ |
| Allowed scopes (from the Brand’s set) | · | · | ✓ |
How multi-tenancy compares
Most identity platforms only give you the Org / App split. Synq adds Brand as a first-class tier — the surface your end-users actually trust.
| Feature | Clerk | WorkOS | Auth0 | Synq |
|---|---|---|---|---|
| Three-tier tenancy (Org / Brand / App) | Org / App | Org / Project | Tenant / App | |
| Multiple consent surfaces under one account | Limited | Enterprise | ||
| Per-Brand provider credentials (BYO OAuth) | Per app | Per tenant | ||
| Per-Brand theming + email sender | Per app | Per tenant | ||
| Brand-scoped custom OIDC scopes | Limited | |||
| Org-wide audit log across all Brands | Limited | |||
| No new account required to spin up a new surface |
Why three tiers matter
Spin up a new product without a new contract
Launching a second brand is a Dashboard click. No new vendor relationship, no new pricing negotiation, no new security review.
Each Brand looks like its own company
Per-Brand BYO credentials mean the Google consent screen shows the Brand’s name. Per-Brand email templates mean the sign-in OTP arrives from the Brand’s sender. Users see one company; Synq is invisible.
One audit log across every surface
Compliance and security teams get a single source of truth. Filter by Brand for a per-product slice, or zoom out for the whole portfolio.
Apps stay close to platform reality
A web App, an iOS App, and an Android App are three OIDC clients with different secrets, different redirect URIs, and different lifetimes — exactly how OIDC was designed.
Read more
Brands
The trust surface. What every Brand owns — theming, providers, scopes, emails.
Apps
OIDC clients. The five App types (web, SPA, native, M2M, agent) and how redirect URIs, grants, and scopes work.
Teams & roles
The Org-level membership story — built-in roles, custom roles, and the permission matrix.
Common questions
Start with one Brand, scale to many.
A new Org comes with one Brand pre-created so you can ship sign-in today. Add more Brands when you launch your next product surface — same dashboard, same bill.