Synq Docs
What Synq is, and where to find each part of its reference.
Synq is customer identity for businesses: an OpenID Connect issuer you put in front of your apps. These pages describe what Synq's code does today. Anyone can sign up, verify their email and make an org: its first brand's issuer works at once, on the free Starter plan.
The concepts explain each part in more depth: orgs and brands, apps and APIs, users, sessions and tokens, consent, and plans. The guides walk through each thing Synq does: every way to sign in, token gates, linking, signing out, agents, MCP and webhooks.
Orgs, brands and issuers
Your company is an org on Synq. An org has one or more brands, and each brand is one pool of users with its own sign-in. Every brand is its own OpenID Connect issuer at its own host: a brand whose issuer slug is acme signs people in at https://acme.auth.synq.build. A brand's issuer slug never changes, because every token and every app names its issuer.
Each issuer publishes its endpoints (authorize, token, userinfo and the rest) in its discovery document, at /.well-known/openid-configuration on the issuer's host. Apps sign people in with the authorization code flow and PKCE (S256), and every redirect URI must match one the app registered exactly.
The management API
Everything about an org (its brands, apps, APIs, users, members, roles, webhooks, API keys and audit log) is managed through the management API at https://api.synq.build/v1. It takes an org API key, or an access token for the management API from Synq's own sign-in at https://accounts.synq.build. Each route needs one permission, and every error is a problem document with a stable code.
The management API reference lists every route.
The account API
A brand's own apps can let a signed-in person manage their own account (their profile, sessions, passkeys and linked sign-in methods) through the account API, at /me on the brand's issuer, with an access token for it.
The account API reference lists every route.
Webhooks
An org can subscribe to events: each one is a row of its audit log, delivered as a signed POST (Standard Webhooks). Webhook events lists them all.