Build a Sign in with Syntic app

Your own application can let people sign in with their Syntic account and call Syntic models on their own plan, instead of you paying for their usage with your API key. This uses the same OAuth 2.0 authorization-code flow with PKCE that Syntic’s own apps use, described step by step on Sign in with Syntic.

When to use it

Register the app

Register with an Admin key using Register an OAuth app. Choose:

• Client type. public for desktop, mobile and single-page apps (no secret can be kept safe there). confidential for server-side apps.
• Redirect URIs. Exact matches only, no wildcards. Desktop apps may use a loopback address with any port.
• Scopes. Ask for the fewest you need. user:profile to know who signed in; user:inference to call /v1 on their behalf.

The flow in brief

1. Send the person to https://app.syntic.ai/oauth/authorize with your client_id, redirect_uri, scope, a state value and a PKCE code_challenge.
2. They approve. Syntic redirects back with a code.
3. Exchange the code (plus the PKCE verifier, and your secret if confidential) for an access token and refresh token.
4. Call /v1 with Authorization: Bearer <access token>. Usage counts against the person’s organization and plan.
5. Refresh before expiry; revoke on sign-out.

What people see

The approval screen shows your app’s name and logo, the organization they are signing in to, and plain-language descriptions of the scopes. Apps with audience: any show “Reviewed by Syntic” once approved; until then only your own organization’s members can sign in.

Rules

• No scope lets an app create API keys. The access token is the credential.
• Access tokens last one hour; refresh tokens 30 days of inactivity.
• People can see and revoke every app they approved in their account settings, and owners can revoke apps organization-wide.
• Plan limits apply to the person’s organization exactly as in Syntic’s own apps, including 402 quota_exhausted.