Scopes & consent.
What users authorize.
Standard OIDC scopes plus Brand-scoped custom scopes plus per-App allowed-scopes ceilings — the three layers that decide what an App can ever ask for and what the user actually agrees to grant. With per-grant revocation surfaced in the user's own dashboard.
Standards plus your own
Synq does not lock you into the OIDC core set. Define custom scopes per Brand and your Apps can request them like any other. Your backend verifies the scope claim on the access token the same way it verifies `openid` — no special plumbing.
Standard OIDC
openid · profile · email · offline_access. The spec-defined set every OIDC issuer ships. Apps almost always want these.
Brand-scoped custom
Defined per-Brand: `marketplace:read`, `wallets:write`, `analytics:read`, whatever your product uses. Lives in the Brand’s scope catalog so apps under that Brand can request them.
Per-App allowed-scopes
A hard ceiling on what each App can ever request. Filters against the Brand catalog. Lets you sandbox an untrusted or partner App to a narrower slice.
What the user sees
On first sign-in to a new App, Synq renders a consent screen listing every scope the App is requesting along with a human-readable description. The user can accept, deny, or partially approve. Synq stores the grant so future sign-ins skip the screen — until the App asks for a new scope.
User-facing, by App
Every user has a Synq dashboard listing every App they have authorized and every connected sign-in method. Revoking an App breaks its refresh-token chain immediately and the existing access token expires naturally (max one hour). The revocation is audit-logged and a `grant.revoked` webhook fires so your app can mirror the state.
Read more
Brands
Where Brand-scoped custom scopes live. Define them once on the Brand and every App under it can request them.
Apps
Where allowed-scopes ceilings live. Apps can never request scopes outside their allowlist.
Audit log
Every consent grant and every revocation is recorded with the actor user and the App involved.
Common questions
Standards-shaped scopes you fully own.
Spec-compliant authorization plus your own catalog. Verify on any backend with any JWT library — no proprietary check API.