Skip to main content

Authentication Overview

SyAuth provides secure, standards-based authentication for your applications.

API Base URL​

The generic API URL for SyAuth is:

https://api.syauth.com/e/v1

Note: If you are using a self-hosted instance or a specific region, check your Dashboard for the correct URL.

Supported Authentication Methods​

MethodDescription
Email/PasswordTraditional email-based authentication
Social LoginGoogle, GitHub, LinkedIn, Facebook
Custom DatabaseAuthenticate against your own user database

OAuth 2.0 & OpenID Connect​

SyAuth implements industry-standard protocols:

  • OAuth 2.0 - Authorization framework
  • OpenID Connect (OIDC) - Identity layer on top of OAuth 2.0
  • PKCE - Proof Key for Code Exchange for enhanced security

Concepts: User vs Machine​

It's important to choose the right flow for your use case:

1. User Authentication (Interactive)​

Question: "Who is this person?"

  • Goal: Identify a specific human user (e.g., "Alice" or "Bob").
  • Why wait? The user must prove their identity (password, 2FA, biometric) and consent to giving your app access to their data.
  • Use Case: Mobile apps, websites, SPAs where a human is clicking buttons.

2. Machine-to-Machine (Non-Interactive)​

Question: "What is this service?"

  • Goal: Identify a backend system (e.g., "Billing Service" or "Nightly Cron Job").
  • Why valid? The system holds its own credentials (client_id + client_secret) and doesn't need human permission to do its job.
  • Use Case: Backend APIs, daemons, CLI tools.
  • Go to Machine-to-Machine Guide →

Authentication Flows​

The most secure flow for web applications:

Getting Started​

Using the Next.js SDK​

The SDK handles authentication complexity for you:

import { useSyAuth } from '@syauth/nextjs';

function MyComponent() {
  const { 
    loginWithRedirect,  // Start login flow
    logout,             // End user session
    isAuthenticated,    // Check auth status
    user,               // Current user data
  } = useSyAuth();
  
  // Your component logic
}

Direct API Integration​

For custom implementations, see the the OAuth 2.0 endpoints.

Security Features​

FeatureDescription
PKCEPrevents authorization code interception
Token RotationRefresh tokens are rotated on use
Token RevocationInvalidate specific or all tokens
Secure CookiesHttpOnly, SameSite, Secure flags

Next Steps​

Start with Login & Logout to implement basic authentication.