Synq for AI agents.
Auth, agent-native.
Synq is one of the only auth platforms marketed for the agentic era. A canonical /llms.txt for coding agents, the OIDC device flow for sign-in on clients without a browser, and an azp claim on every token so backends can tell agents from users.
Built for what comes next
Device flow built in
RFC 8628 — the OIDC grant designed for CLIs and AI agents. The agent gets a URL + code; the user authorizes on a phone or laptop; the agent polls until consent lands. Real session, no browser required.
The azp claim is the agent identity
Every access token carries an azp claim identifying the calling client App. Your backend branches on it to distinguish a web call from an agent call. Audit log surfaces it on every entry.
Scoped App registrations
Register a dedicated Agent App with a hard scope ceiling. An agent that only ever needs openid profile cannot request anything more — even if the agent itself misbehaves.
Coding agents can ship Synq for you
docs.synq.id/llms.txt indexes every doc page, install command, and snippet. Claude Code, Cursor, Windsurf, any tool that respects the convention resolves "ship Synq on Next.js" with one fetch.
The shipped pieces
Device flow
RFC 8628, end to end. How CLIs and AI agents sign in without a webview.
M2M
When the agent acts on its own behalf (no user consent), client_credentials is the right grant.
AI-agent developer guide
llms.txt, device-flow snippets, and the azp-claim pattern explained.
OIDC issuer
The protocol everything is built on. Standard claims, JWKS, no SDK lock-in.
Common questions
The auth surface agentic apps need.
Device flow + llms.txt + azp claim. Drop the snippets into your agent and ship.