Your own apps at the providers

By default a brand signs in through Synq's own app at each provider, so the provider's page names Synq. To have it name you, register your own app there and give Synq its client id and secret: for every brand of the org, or for one brand. A brand signs in through its own app, else its org's, else Synq's. This needs a plan with auth.byo_connections (otherwise plan_feature_unavailable).

Setting oneCopy Anchor Link

1. Find the redirect URIs to register. Each is a brand's own callback for that provider, on the brand's issuer host (https://acme.auth.synq.build/federation/google/callback, say). An org's app signs in every brand without an app of its own, so the org's list names one per live brand (redirect_uris). For one brand's own app, the brand's list names its redirect_uri.
2. Make an app at the provider and register exactly those redirect URIs. For Microsoft, also turn on the auth_time optional claim in its token configuration, or fresh sign-ins through it are refused. For Google, turn on Session age claims (Google Auth Platform, Settings, Advanced settings, which Google offers a published, verified app): without it Google never says when someone signed in, so fresh sign-ins through it are refused too.
3. Give Synq its client id and secret, for the org or for one brand. For Apple, the client id is the app's Services ID, and instead of a secret you give its team_id, the Sign in with Apple key's key_id and the key itself (private_key, its .p8 file): Synq signs the client secrets it sends Apple with it. Also register Synq's sending domain with the Apple app, for mail to private relay addresses.

Synq first asks the provider whether it takes the app, so a wrong id or secret is refused with connection_rejected and nothing is kept; service_unavailable means the provider couldn't be reached. The secret is kept sealed and never returned: answers carry the client id and the redirect URIs. Writes are limited to 10 a minute per org.

A brand made later is signed in by the org's apps too, so register its callback with each of them: the answer that makes the brand names every one in its warnings (org_provider_apps_need_redirect_uri). Synq's own apps need nothing registered.

Setting an app doesn't turn the provider on: turn it on for each brand that should offer it. Forgetting an app never needs the plan feature, so an org that moved down can still clean up.

GitHub: an OAuth App takes one callbackCopy Anchor Link

A GitHub OAuth App registers exactly one callback URL, so make one for one brand, with its callback (https://acme.auth.synq.build/federation/github/callback, say), and give it to that brand. For an org's app, which signs in several brands, make a GitHub App instead (GitHub's developer settings, under GitHub Apps): it takes up to ten callback URLs, signs people in the same way, and needs Email addresses: read under its account permissions, or GitHub gives Synq no address. Leave Request user authorization (OAuth) during installation off: Synq uses each person's token once, to read who signed in, and keeps none. Synq's own GitHub App is what signs people in until you bring yours.

Matrica: your own app onlyCopy Anchor Link

Matrica lets Synq have only two apps, and Synq's own sign-in uses both, so Matrica signs your users in only through your own Matrica app. With none, your brand doesn't offer Matrica: turning it on answers own_app_required, with required_plan when your plan doesn't include bringing apps, and the brand's list says synq_app: false. Every other provider works through Synq's app until you bring yours.

1. Ask Matrica for an OAuth app in its developer settings, and register the redirect URI Synq names for the brand (https://acme.auth.synq.build/federation/matrica/callback, say), or one per brand for an org's app.
2. Give Synq the app's client id and secret, for the org or for one brand, with matrica as the provider. In the dashboard, it's Use your own app at Matrica under the brand's sign-in methods.
3. Turn Matrica on for the brand. Its button now signs people in through your app. Forget the app later, and the brand stops offering Matrica: nothing falls back to Synq's.

Google's brand verificationCopy Anchor Link

Google shows your logo on its sign-in screen only once it has verified your app's brand, and it checks each redirect URI against its authorized domains: the top domain of each, which you prove you own in Google Search Console. A brand's own issuer host is under Synq's domain, which only Synq can prove, so a Google app with that callback can't be verified.

To publish a verified Google app, sign the brand in on a custom domain of yours, such as login.acme.com:

1. Add the custom domain and wait until it is active.
2. Move every app of the brand to the custom domain's issuer. A sign-in on the brand's own host calls Google back there, which a verified app won't have registered.
3. Register only the custom domain's callback with your Google app, https://login.acme.com/federation/google/callback, add acme.com as an authorized domain, and verify it.
4. Give Synq the app for the brand, then submit it for Google's verification.