Skip to main content
SynaptaGrid Platform
← All capabilities
Available now

Platform capability · Sign-in & Identity

Enterprise sign-in inside your own interface

Every sign-in screen carries your brand

A complete OIDC sign-in provider and identity service. It covers each step of sign-up and sign-in: email and password, social sign-in, enterprise SSO, MFA, password reset, email verification, reCAPTCHA bot protection and account recovery. A global sign-in directory sends each person to the region that holds their account.

Built in

What you get

  • Connect any app that supports OIDC and let users sign in with their platform account
  • Standard OIDC authorization-code flow, with refresh tokens replaced on every use
  • Email and password sign-up with a verified email address and reCAPTCHA
  • Social sign-in with Google, Microsoft, GitHub or Facebook. The user goes straight to that provider
  • Enterprise sign-in through SAML, LDAP or OIDC
  • MFA with an authenticator app, set up by QR code, with backup codes
  • Password reset, account recovery and credential rotation
  • Password rules: expiry, no reuse of earlier passwords and forced change
  • If an old refresh token is used again, every token that came from it is cancelled
  • End every session for one user, or for a whole organization, in one action
  • Signing keys are rotated, and a single token can be cancelled at once
  • Service accounts for scripts and integrations: a named account with a role, API keys, an audit trail and a plan limit. A key is exchanged for a short-lived token. Keys can be rotated with a 24-hour overlap, and revoked or disabled at any time
  • A global sign-in directory sends each person to their region
  • Each organization’s user accounts, passwords and MFA are stored in that organization’s own database
  • An API with no screens of its own, so you build the pages. Tokens are kept in Secure, SameSite=Lax cookies on the parent domain
  • Sign-in rules for each organization: SSO only, passwords turned off, allowed IP addresses
Under the hood

How it works

Your brand on every screen

Email and password are checked on the server. Your sign-in form sends them to the platform’s sign-in service, and the user does not pass through another login page. Social sign-in sends the user straight to Google, Microsoft, GitHub or Facebook. Enterprise SSO sends the user straight to their company’s identity provider.

Use the platform as your OIDC sign-in provider

Connect OIDC-compatible apps to the platform so users sign in with their platform account. Register each app as an OIDC client and set its redirect URLs and allowed scopes. Grafana uses this for access to the monitoring dashboards, and other compatible apps can connect the same way. The platform issues tokens through the OIDC authorization-code flow, supports PKCE and rotates its signing keys.

A stolen refresh token stops working

A refresh token is replaced each time it is used, and the platform records which token each new one came from. If an old refresh token is used again, every token in that chain is cancelled and the user signs in again. A stolen refresh token stops working the next time it is used.

Pairs well with

Related capabilities

Authorization

Roles, attribute rules and resource hierarchies in one permission system

Audit

An audit trail that can only be added to, where tampering shows

Organizations, Plans & Settings

One record of every customer, app, plan and setting, with overrides for each customer

Enterprise SSO & Directory

SAML, LDAP and OIDC: users sign in with their company’s own directory

Want a deeper walkthrough of Sign-in & Identity?

A solution architect will demo the live service against your domain model.

Get a deployment assessment