Security.
Built into every layer.
Identity is the front door. Synq runs every door the same way: encryption at rest, mandatory PKCE on public clients, anti-CSRF and nonce on every flow, rate-limited endpoints, JWKS-published rotation, single-use refresh, HMAC-signed webhooks, and an immutable audit log. The architecture of a platform built for production.
Nothing you have to remember to turn on
Every entry below is on by default for every Org. None of them require a configuration flag. If you forget to read this page, your platform is already running them.
Encryption at rest
Every client_secret, BYO OAuth credential, webhook subscription secret, and API key is encrypted with AES-256-GCM in a brand-scoped Mongo collection. Plaintext exists only briefly during a token exchange and is never logged.
PKCE on every public client
SPA, native, and agent Apps must use PKCE (S256). Synq rejects authorization code exchanges without a verifier. The PKCE state never leaves the calling client and the server until the exchange — eliminating an entire class of code interception attacks.
State + nonce on every flow
Anti-CSRF state and ID-token nonce are required and validated server-side. Mismatched state or nonce rejects with a typed error before any token is issued.
JWT signing with RS256 + JWKS
Access and ID tokens are RS256-signed. Public keys are exposed via JWKS with a `kid` header on every token so any consumer can verify. Key rotation publishes both keys during a grace window so libraries pick up the new key on `kid` mismatch.
Refresh-token rotation
Refresh tokens are single-use. Every exchange rotates the token; using an already-rotated refresh fails with `invalid_grant`. Reuse detection serializes per-session at the API.
Rate limiting
Auth endpoints are throttled per IP — standard sign-in flows at 20 req/min, wallet authorization tighter at 10 req/min. Webhook endpoints are throttled per subscription to prevent receiver overload.
Account lockout + soft delete
Deletions stage through a `pendingDeletionAt` grace window so accidental account deletions are reversible. Hard deletion is a background job that runs once the grace expires.
HMAC-signed webhooks
Every webhook delivery is signed with a per-subscription HMAC-SHA256 secret. Receivers verify in constant time. Auto-disable kicks in after repeated 4xx / 5xx responses.
Immutable audit log
Every identity-affecting action is recorded — sign-ins, grants, revocations, member changes, secret rotations, App edits. Append-only. Prunes only past retention.
Read more
Audit log
The durable record of every identity action. The first place to look when you need to answer a security question.
BYO OAuth credentials
Why per-Brand credentials are also a security boundary: your usage, your quota, your rotation cadence.
OpenID Connect issuer
The standards Synq is built on. Every security guarantee maps to a spec line you can audit.
Common questions
Security defaults that just work.
Every Org runs the same set out of the box. No config flags, no opt-ins, no surprises.