Skip to main content

Verify your integration

Use a test workspace and an email address you control. Complete the checks for the flow you use before directing real users to it.

This is a final verification list. Start with dashboard setup and your chosen hosted OAuth or email/password walkthrough; those pages explain how to obtain the values and run the requests below.

If you are trying SyAuth without an app​

Use the manual test. Check these results in order:

  1. The test receiver is running and has printed the authorization URL you will open.
  2. You can sign in as a test user in the intended workspace and complete email verification if prompted.
  3. After approval, the browser reaches http://127.0.0.1:8080/callback?... and says “Callback received and state matched. Return to your terminal.”
  4. The terminal prints the authorization code and original verifier. The token request returns HTTP 200 with access_token.
  5. The userinfo request returns HTTP 200 and the identity belonging to that test user.

These checks confirm the manual login/API test. Connecting it to your own app and checking the production behavior below require application code.

Before a developer releases an application​

  1. Sign in to the dashboard and confirm the intended workspace and active plan.
  2. If using management automation, make the workspace read request and check for HTTP 200.
  3. Confirm your public client ID, client type, scopes and exact callback URI.
  4. Register an application test user and confirm verification email delivery.
  5. Complete sign-in, then retrieve the user's profile or OAuth userinfo with the matching token type.
  6. Exercise failures that apply to your flow, such as an incorrect password, expired verification code, denied OAuth consent and expired session; show an actionable message in your app.
  7. For OAuth, reject a mismatched state/nonce, validate the ID-token signature/issuer/audience/expiry, and reject an unregistered callback URI.
  8. Exercise password reset and sign-out. Clear your application's session as well as revoking tokens where applicable.
  9. If using MFA, passkeys, SCIM or SAML, complete the feature-specific availability checks.

Record endpoint, status, sanitized response and expected result. Example responses in these docs illustrate response shapes; they are not a guarantee that every feature is enabled on your plan or deployment.