Skip to main content

Key Concepts

Understand the core building blocks of SyAuth.

The SyAuth Hierarchy​

SyAuth organizes resources in a simple hierarchy designed for multi-tenancy and scalability.

1. Workspaces​

A Workspace is your top-level organizational unit and multi-tenant container. It acts as a security boundary for all your resources.

  • Isolation: Users, groups, settings, OAuth clients, API tokens, and email templates in one workspace are completely separate from those in another.
  • Collaboration: You can invite team members to your workspace to manage resources together. The workspace creator is the Owner, while invited developers are assigned the Member role.
  • Environment Management: We recommend using separate workspaces for Development, Staging, and Production to ensure total separation of user data.
  • Multi-tenancy: Each workspace maintains its own unique set of users (even if they share the same email address as users in other workspaces).

👉 Learn more: Managing Workspaces

2. OAuth Clients (Applications)​

An OAuth Client represents your software application (website, mobile app, or backend service) that uses SyAuth for authentication.

  • Public Clients: Used for SPAs, mobile apps, and modern server-side apps (Next.js, Django). Since they use PKCE, they don't require a Client Secret, making them easier to manage and more secure.
  • Confidential Clients: Used for machine-to-machine integrations or legacy server-side apps that cannot use PKCE. They require a Client Secret.
  • Credentials: Every client has a unique Client ID (public). Confidential clients also receive a Client Secret (private).

👉 Learn more: Configuring OAuth Clients

3. Users​

Users are the individuals who authenticate into your applications.

  • Identity Providers: Users can Register/Login via email/password or social providers (Google, GitHub, etc.).
  • Profiles: SyAuth stores basic profile data like name, email, and verification status.
  • Custom Data: If using a Custom Database, SyAuth can authenticate users directly against your existing infrastructure.

👉 Learn more: User Profiles

4. Groups​

Groups allow you to implement Role-Based Access Control (RBAC) by organizing users into logical sets.

  • Memberships: A user can belong to multiple groups (e.g., Admins, Premium, Beta-Testers).
  • Claims: Group memberships are included in the ID Token as JWT claims, allowing your app to make permission decisions instantly.

👉 Learn more: Managing User Groups

5. Security Protocols​

SyAuth is built on open standards to ensure your application's security and interoperability.

  • OAuth 2.0 & OIDC: The industry standard for authorization and identity.
  • JWT (JSON Web Tokens): Securely transmits identity information between SyAuth and your application.
  • PKCE: Mandatory for modern web and mobile apps to prevent code interception.

👉 Learn more: Authentication Overview

Next Steps​