Orgs, brands and issuers
Your company is an org on Synq; each of its brands is one pool of users with its own sign-in and its own issuer.
Orgs
An org is a tenant: your company on Synq. A person signed in to Synq makes an org and owns it; an API key never makes one. An org has:
- Members, each with a role: the owner, admins, members, or a role the org made from any set of permissions. The owner can hand the org to another member.
- API keys (
sk_live_…in production,sk_test_…elsewhere), each with the permissions it was given, for the management API. - Brands, below, and a plan, which sets how many brands and apps it may have (see plans and usage).
- An audit log of every change its people, its keys, its users and Synq make, which webhooks can deliver as it happens.
An org's slug may change. Deleting an org stops it at once (its routes, keys and issuers) and purges it 30 days later.
Brands
A brand is one pool of users with its own sign-in: its apps, its APIs, its users, its sign-in methods and its look (logo, colours, support address, policy links). A user of one brand is never a user of another, even with the same email address, and a session at one brand never signs anyone in to another.
Every org comes with a default brand, and makes more as its plan allows. Use a brand for each product or customer base whose people shouldn't share an account.
Issuers
Each brand is its own OpenID Connect issuer, at its own host: a brand whose issuer slug is acme signs people in at https://acme.auth.synq.build. The issuer slug is chosen when the brand is made, the org's slug by default, and never changes: every token and every app names its issuer, so changing it would break them all. A deleted brand's slug is never used again.
Each issuer publishes its endpoints in its discovery document, at /.well-known/openid-configuration on its host, and its signing keys at the jwks_uri it names. Every issuer follows the same rules:
- the authorization code flow only, with PKCE (S256) on every request
- redirect URIs always sent, and matched exactly
issin every authorization response- ID tokens with
auth_time,acrandamr - cookies that belong to the issuer's own host alone
A brand on a plan with custom domains can also answer on a host you own, such as login.acme.com: a custom domain is a second issuer of the brand, with the same users, apps and keys and its own iss, beside its own issuer, which never changes.
The issuer also serves the brand's hosted pages: sign-in and sign-up, consent, sign-out and the device flow's, in the brand's look. See Make a brand and Change a brand.