Sign-in and OAuth glossary
Terms for signing people in with Syntic. Shorter definitions of the core API terms are on the main Glossary.
Access token
A short-lived bearer token for /v1 calls, valid for an hour.
Audience
Who may sign in to an app: only your organization, or any Syntic user after review.
Client id
The public identifier of an OAuth app.
Code challenge
The hash of the verifier sent at the start of sign-in.
Code verifier
The random secret the app keeps during sign-in.
Confidential client
A server-side app with a client secret, which also uses PKCE.
Introspection
Asking whether a token is active and what it may do. See introspect.
OAuth app
An application registered to sign people in with Syntic. See oauth apps.
PKCE
Proof Key for Code Exchange: the app proves it started the sign-in by revealing a verifier whose hash it sent earlier. See sign in.
Public client
An app that cannot keep a secret (desktop, mobile, browser). Protected by PKCE and exact redirects.
Redirect URI
Where the browser returns after approval; must match a registered value exactly.
Refresh token
A longer-lived token that obtains new access tokens.
Revocation
Ending a sign-in so its tokens stop working. See revoke.
Scope
A permission an app asks for, such as user:inference.
State
A random value that ties the browser’s return to the sign-in your app began, preventing forged callbacks.