Synq Docs
Management APISign-in providers

Change how a brand signs in with a provider

Turn it on or off, link by email or not, limit Google to one Workspace domain and Microsoft to work and school accounts or one directory. Needs `org.brands.edit`. Recorded as `brand.updated`, naming each setting as `sign_in_providers.<provider>.<setting>`; send null to clear one.

PATCH/v1/orgs/{org}/brands/{brand}/sign-in-providers/{provider}

Turn it on or off, link by email or not, limit Google to one Workspace domain and Microsoft to work and school accounts or one directory. Needs org.brands.edit. Recorded as brand.updated, naming each setting as sign_in_providers.<provider>.<setting>; send null to clear one.

Authorization

bearer
AuthorizationBearer <token>

An org API key (sk_live_…, sk_test_…), or an access token from the Synq issuer (the synq brand, on the accounts host) for this API.

In: header

Path Parameters

org*string
brand*string
provider*string

Value in

  • "google"
  • "github"
  • "microsoft"
  • "apple"
  • "facebook"
  • "x"
  • "discord"
  • "telegram"
  • "matrica"

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

curl -X PATCH "https://example.com/v1/orgs/string/brands/string/sign-in-providers/google" \  -H "Content-Type: application/json" \  -d '{}'
{  "provider": "string",  "enabled": true,  "link_by_email": true,  "hosted_domain": "string",  "microsoft_tenant": "string",  "app": {    "client_id": "string",    "redirect_uri": "string",    "updated_at": "2019-08-24T14:15:22Z"  },  "signs_in_through": "brand",  "redirect_uri": "string",  "offered": true,  "synq_app": true}

List the org's own apps at the sign-in providers GET

One per provider: the org’s own app there (its client id), or null, and the redirect URIs an app there registers, one per live brand: each brand’s own callback, on its issuer’s host. Never a secret. Each brand’s list (`…/brands/{brand}/sign-in-providers`) says which app it signs in through, and its own redirect URI. Needs `org.connections.view`.

Set a brand’s own app at a sign-in provider PUT

The app is the brand’s own, which wins over the org’s. The app at the provider must register `redirect_uri` exactly: the brand’s own callback, on its issuer’s host. Checks the client id and secret with the provider first (a token request it refuses for the code, not the app, when it takes them), then keeps them in place of any before. Microsoft's needs Entra's `auth_time` optional claim turned on, or a fresh sign-in through it is refused. Apple takes no `client_secret`: send its Services ID as `client_id` with `team_id`, `key_id` and the `.p8` `private_key`, from which Synq signs each client secret it sends Apple. Apple delivers mail to private relay addresses only from domains registered with the app, so register the domain Synq sends your brands' email from (the domain of their sender address) under Sign in with Apple for Email Communication, or Synq's email to people who hid their address bounces. Every other provider takes `client_id` and `client_secret`. Recorded as `org.updated` (or `brand.updated`) with the client id, never the secret. 422 `connection_rejected` when the provider refuses the app; 503 when it can't be reached; at most 10 a minute per org (429). Needs `org.connections.edit`, and a plan with `auth.byo_connections` (403 `plan_feature_unavailable` otherwise, naming the plan in `required_plan`); forgetting one never does.