Social accounts
Turn on sign-in with Google, GitHub, Microsoft, Apple, Facebook, X or Discord for a brand, and choose who may use it.
A brand can offer "Continue with" Google, GitHub, Microsoft, Apple, Facebook, X, Discord, Telegram and Matrica. Each is off until you turn it on, and needs an app at the provider: Synq's own, your org's or the brand's (see your own apps at the providers). Matrica takes your own app alone: Synq's apps there sign in Synq itself (Matrica: your own app only). More providers are added over time. To offer some of these alone, or let one app take only some, see Choose the ways to sign in.
Turning one on
List the brand's sign-in providers to see each one's settings, which app it signs in through now (signs_in_through: brand, org or synq), and whether the page offers it (offered). Change one with:
| Setting | What it does |
|---|---|
enabled | Whether the sign-in page offers it |
link_by_email | Whether a sign-in whose provider vouches for the address joins the brand's user who verified it (on by default; Google, Apple and Microsoft vouch, each for some addresses only) |
hosted_domain | Google only: the one Google Workspace domain whose accounts may sign in |
microsoft_tenant | Microsoft only: organizations for work and school accounts, or one directory's tenant id; any account when null |
Turning a provider off takes its button away at once, and a sign-in that began before signs nobody in.
What each provider tells Synq
| Provider | Who the person is | Their email address at Synq |
|---|---|---|
| Google's id for them | Verified for Gmail addresses, and for a Workspace account's address on its own Workspace domain (Google's hd claim); otherwise unverified | |
| Microsoft | Their directory and object ids, the same across apps | Verified only when the ID token's xms_edov claim says the owner of the address's domain was verified; otherwise unverified |
| Apple | Apple's id for them | Verified for Apple's own mailboxes (@icloud.com, @me.com, @mac.com) and private relay addresses; otherwise unverified |
| Facebook's id for them | Unverified | |
| X | X's id for them | Unverified, and only when the app at X asks for people's email (which needs privacy policy and terms URLs on that app) |
| Discord | Discord's id for them | Unverified, and only when Discord verified it |
| GitHub | GitHub's numeric account id, which a rename keeps | Unverified: the account's primary address GitHub checked, else the public one on its profile |
With link_by_email on, a sign-in whose address the provider vouches for (the verified addresses in the table above) signs in to the brand's one user who verified that address and joins their account, never an account whose address nobody proved. Each rule is there to stop someone taking over an account with an address they don't own: a personal Google account made with a work address had it checked only once; a Workspace account's address on another domain says nothing of who owns that domain; and a Microsoft directory's admin can give an account any address ("nOAuth"), so Synq trusts one only with Entra's xms_edov claim, which an app at Microsoft sends once xms_edov is added as an optional claim in its token configuration. A private relay address from Apple is unique to the app, so it never links to another account. GitHub, Facebook, X and Discord never vouch. Otherwise a new identity is a new user, or refused when another user verified its address. Turning link_by_email off only makes linking stricter: such a sign-in is refused. amr is fed.
Apple's private relay delivers mail only from domains registered with the Apple app. Synq's own Apple app has Synq's sending domain registered; an org or brand bringing its own Apple app must register it too, or codes and notices to relay addresses won't arrive.
Fresh sign-ins
When your app asks for a fresh sign-in (prompt=login or max_age), Synq asks the provider for one too, and refuses an answer that doesn't show when the person signed in there. Only Google and Microsoft can show it, so GitHub, Apple, Facebook, X and Discord aren't offered when a fresh sign-in is asked for. A Microsoft app needs Entra's auth_time optional claim turned on in its token configuration, and a Google app needs Session age claims turned on in the Google Auth Platform.
Microsoft can be made to ask the person to sign in again, so when its answer is too old Synq's page offers "Sign in to Microsoft again", once. Google never asks someone already signed in to Google to sign in again, whatever it is asked: its answer passes only when the person's Google sign-in is that recent. When it isn't, Synq's page leads with "Use another way to sign in", and offers trying again after signing out of Google, rather than asking Google the same thing again; for the rest of that sign-in, Google's button says to sign out of Google first. A provider that didn't say when the person signed in at all isn't offered again in that sign-in.
Add synq_method=google (or github, microsoft, apple, facebook, x, discord) to the authorization request to go straight to that provider.
What GitHub says of an account
GitHub's sign-in also says what kind of account it is and how established: its type (User, Organization or Bot), when it was made, and how many public repositories and followers it has. Synq reads them again at every sign-in with GitHub and keeps them on the person's GitHub identity, as details with details_read_at, which a user's details show. Use them to judge an account, as a free service does to keep out throwaway accounts: an account a month old, a person's, with something public.
Links opened inside other apps
A link tapped in X, LinkedIn, Instagram, Facebook, TikTok or Snapchat opens in that app's own browser, where Google refuses to sign anyone in and passkeys usually can't be reached. Synq's sign-in page recognizes these browsers. It leaves Google and passkeys off there, as long as another way to sign in is left, and says why, so the person signs in another way or opens the page in Safari or Chrome. Email codes, the other providers and passwords keep working inside them.