Users and ways to sign in
A user belongs to one brand, and signs in with any of the ways their account holds.
Users
A user is one person at one brand. Someone new becomes a user by signing in, when the brand lets people sign up (it does by default; turn it off with sign_up_enabled), and a tenant can make one too. The same person at two brands is two users, who share nothing.
A tenant reads, searches and changes its users, keeps up to 16 KB of its own metadata on each, disables one, ends their sessions or schedules their deletion: a deleted user is purged 30 days later. A person can see and change their own profile, sessions and ways in through the account API, from one of the brand's own apps.
Ways to sign in
Each way a user signs in is an identity of their account, at most 20 per person:
| Identity | Its subject | amr |
|---|---|---|
| An email address, with or without a password | The address, lowercase | otp for an emailed code or link, pwd for a password |
| A passkey | Its credential id | swk (synced) or hwk (bound to its device), with user |
| A Solana wallet | Its address | wallet |
| An account at Google, GitHub, Microsoft, Apple, Facebook, X or Discord | The provider's id for the person | fed |
GitHub, X, Discord, Telegram and Matrica also give the person's username there, which their identity keeps as its handle, without the @, and takes again at each sign-in, since people change theirs. It's for showing people: Synq always finds the person by the provider's id for them, never by a handle. A new account takes the handle, lowercase, as its username when it's a username people can choose (3 to 64 letters, digits and . _ -, starting and ending with a letter or digit) and nobody at the brand has it; so does an account without a username that adds one of these ways to sign in. A username the account already has stays.
ID tokens and access tokens say how the person signed in, in amr, and how strongly in acr: urn:synq:loa:2 for a passkey, urn:synq:loa:1 otherwise. A person adds and removes ways to sign in through the account API: see identities. The last way in can never be removed.
Verified email addresses
An address is verified once Synq knows its holder reads it: they signed in or verified it with a code or link Synq emailed, or the provider vouched for it: Google for Gmail addresses and a Workspace account's address on its own Workspace domain, Apple for its own mailboxes and private relay addresses, and Microsoft only when its xms_edov claim says the owner of the address's domain was verified. A password sign-up leaves the address unverified until its holder verifies it, and Synq never takes Facebook's, X's or Discord's word for an address. ID tokens carry email_verified.
At one brand, one user at most has a given verified address. That's what keeps accounts from being taken over:
- A new way to sign in whose verified address another user has is refused, unless the provider vouches for the address (Google, Apple or Microsoft, as above, but never an Apple private relay address) and the brand links by email (the default): then it signs in to that user and joins their account.
- A code or link Synq emailed to an address a user verified signs in to that user, whichever way they signed up: reading the mailbox proves it's them, and the address becomes one of their ways in. It never signs in to an account whose address nobody proved: proving that one is the next rule, or, for an address a provider gave unverified, a new user.
- An account whose address nobody proved takes no new way to sign in until the address is verified.
- Proving the address of an account that never proved it, with an emailed code, hands the account to whoever proved it: the address is verified, every other way in its maker added is removed, and every session ends.
Monthly active users
A user counts as active in a calendar month (UTC) once they get tokens in it, by signing in, refreshing or through the device flow. Machines never count. See plans and usage.