Skip to main content

Configure your application

Configure the application you are building with values from your SyAuth workspace. Environment-variable names below are examples for your code, not mandatory framework names.

This page is for the developer connecting an existing app. If you have no app and just want to try login, use the manual test; that script does not require an environment file. An environment variable is a setting that your app reads when it starts or builds. The developer must decide where these settings belong for the framework in use.

Complete dashboard setup first. Put the values in your app's environment or configuration file using its framework's loading rules. Creating a file alone does not connect the app to SyAuth: your code must read the values and implement the selected sign-in flow.

SYAUTH_API_URL=https://api.syauth.com/e/v1
SYAUTH_CLIENT_ID=your_public_client_id
SYAUTH_REDIRECT_URI=http://127.0.0.1:8080/callback
# Confidential server-side applications only:
SYAUTH_CLIENT_SECRET=your_confidential_client_secret
# Only if this server automates management operations:
SYAUTH_DEVELOPER_TOKEN=your_scoped_developer_access_token
SettingWhat to put there
SYAUTH_API_URLKeep the hosted API base above; do not append /e/v1 twice when constructing requests
SYAUTH_CLIENT_IDThe application's OAuth client_id from its dashboard details
SYAUTH_REDIRECT_URIYour running app's registered callback URL; replace the local example if your host, port or path differs
SYAUTH_CLIENT_SECRETThe raw secret shown at confidential-client creation/reset; omit this setting for a public client
SYAUTH_DEVELOPER_TOKENA developer access token with the scopes your server's management operations require; omit it if you only need user sign-in

Load these using your application's configuration mechanism and restart or rebuild as required by your framework. Commit an example file with placeholders; keep actual secrets outside version control. Browser apps can receive the public client ID, API URL and callback URI. A NEXT_PUBLIC_ or similar browser-exposed prefix must never be used for a confidential secret or management token.

Redirect URLs and browser requests​

Register each callback exactly, including scheme, hostname, port, path and trailing slash. localhost and 127.0.0.1 are different hosts. For http://127.0.0.1:8080/callback, your app must be listening on port 8080 with a /callback handler. Use HTTPS for deployed applications. Carry state, nonce and PKCE across the same login attempt; do not start a new verifier during the callback. The sign-in attempt example shows how to generate them.

For browser API calls, compare the browser's Origin with the origin of the registered redirect URI. A request that succeeds in curl can still fail browser CORS checks. Report the origin, method, endpoint and preflight result when requesting help. Do not work around CORS by putting server credentials into the browser.

Your application controls its own session cookies. Use secure cookie settings appropriate for your deployment and preserve SyAuth cookies during hosted sign-in. Clearing only a browser token variable does not revoke every session or refresh token.

Check that configuration is being used​

  1. Restart or rebuild the app after changing its settings, as required by its framework.
  2. Start from the app's Sign in action. Check that the outgoing authorization URL uses the intended client_id and callback address.
  3. Complete login and approval. Check that the browser returns to the registered callback and that the app handles the result.
  4. If old values still appear, check which configuration file/process the app actually loads. If login reaches the callback but reports a missing session, check the saved attempt and cookies. See API and login troubleshooting.

The configuration is working when the app uses the intended client and can complete its login flow. A saved .env file alone is not that check.