Security

SecretsCopy Anchor Link

Synq keeps no secret it doesn't have to:

• App secrets, API keys and passwords are hashed. An app's secret and a new API key are in the answer that makes them, once; Synq can't show them again.
• Signing keys, webhook secrets and the secrets of your apps at the providers are encrypted at rest with a key Synq keeps apart from the database.
• Emailed codes are kept as an HMAC, so a copy of the database can't try every code, and links as hashes.
• Tokens, codes, cookies, passwords and keys never reach a log, an error message or an audit row.

Rotating keys and secretsCopy Anchor Link

• Signing keys rotate on their own, per brand: a new key is published in the issuer's JWKS a day before it signs, signs for 90 days, and stays published a day after, then its private key is erased. Fetch the issuer's jwks_uri again when you meet a key id you don't know, and never pin one key.
• An app's secret: rotate it, and the old one keeps working for the overlap you ask for (a day by default, 7 at most, or none).
• A webhook's secret: rotate it, and deliveries are signed by both for 24 hours.
• An API key: make a new one, switch over, then revoke the old one, which stops working at once.

Why an access token can't be revoked earlyCopy Anchor Link

An access token for one of your APIs is a JWT: your API checks it itself, against the issuer's keys, without asking Synq. That's what makes it fast, and it means nothing can take it back once issued: it works until it expires, 5 to 15 minutes after it was issued, as the API says. When something ends a person's access (a sign-out, a password reset, the tenant ending their sessions), their refresh tokens stop at once, so no new access token comes; what was already issued runs out within the API's lifetime. Keep that lifetime short for an API where it matters.

An opaque token (one asked for without an API) and a refresh token are kept by the issuer, so the app they were issued to can revoke them at once.

Refresh tokensCopy Anchor Link

A refresh token rotates on every use, and a used one presented again revokes everything issued under its grant: only a stolen copy would be presented twice. See sessions, grants and tokens.