Connecting an identity provider
Connect Auth0, Clerk, Amazon Cognito, WorkOS, Keycloak or Microsoft Entra External ID in the dashboard so Syncanix can authenticate your end users through the provider you already use.
The identity-provider adapter is the recommended way to authenticate your end users. You connect your provider once, per environment, and Syncanix verifies the tokens it issues — no extra secret to manage and no second login for your users.
Where to set it up
Open Settings → Federation in the dashboard. Choose your provider, fill in the fields below, and save. Each provider needs only a handful of values, all of which you copy from your provider’s own dashboard.
Supported providers
Six identity providers have first-class dashboard integrations — Auth0, Clerk, Amazon Cognito, WorkOS, Keycloak, and Microsoft Entra External ID — and each section below lists the exact fields the dashboard asks for. Beyond these, Syncanix also works with any standard OIDC provider and with several other shapes of identity setup.
Connect Auth0
You’ll find all three values on your Auth0 application’s settings page.
- Tenant domain
- Your Auth0 domain, for example acme.us.auth0.com.
- Application Client ID
- The Client ID of the Auth0 application your users sign in to.
- API audience (optional)
- Set this only if your tokens target a specific API audience, for example https://api.acme.com.
Connect Clerk
Copy these from your Clerk instance settings.
- Instance URL
- Your Clerk frontend URL, for example https://acme.clerk.accounts.dev.
- Client ID
- The Client ID Clerk issues for your application.
Connect Amazon Cognito
Take these from your Cognito user pool and its app client.
- Cognito domain
- Your hosted-UI domain, for example acme.auth.eu-central-1.amazoncognito.com.
- App client ID
- The app client ID from your Cognito user pool.
- AWS region
- The AWS region your user pool runs in, for example eu-central-1.
- User pool ID
- The ID of your Cognito user pool, for example eu-central-1_AbCdEf123.
Connect WorkOS
WorkOS uses single sign-on, so it needs your client and organization identifiers.
- Client ID
- Your WorkOS Client ID, for example client_xxxxxxxx.
- Organization ID
- The WorkOS organization your users belong to, for example org_xxxxxxxx.
Connect Keycloak
Take these from the realm your users sign in to.
- Keycloak base URL
- Where your Keycloak server lives, for example https://auth.acme.com.
- Keycloak realm
- The realm name your end users belong to.
- Client ID
- The client your users sign in through, within that realm.
Connect Microsoft Entra External ID
For customer-facing sign-in on Microsoft’s external identity service. Take these from your external tenant.
- Directory (tenant) ID
- The identifier of your external tenant.
- Client ID
- The application registration your users sign in to.
- Where sign-in is hosted
- Either your tenant subdomain or a custom authority URL if you use your own domain. One of the two is required; the dashboard marks both optional because either will do.
Beyond the dashboard providers
If your identity setup doesn’t match a dashboard form, there is still a path — Syncanix ships an adapter for each of the common shapes:
- Any OIDC provider — @syncanix/oidc
- Works with any standard OpenID-Connect issuer: it discovers the signing keys from the issuer’s well-known configuration and verifies tokens against them.
- Your own JWTs — @syncanix/custom-jwt
- For apps that issue their own standards-compliant JWTs: point it at your JWKS endpoint and map your claim names.
- Opaque tokens — @syncanix/introspection
- For tokens that can’t be verified locally: verifies each one via your authorization server’s RFC 7662 token-introspection endpoint.
- Cookie sessions — @syncanix/bff
- For cookie-based sessions where no token may reach the browser: verifies the user through a whoami endpoint on your own backend.
Acting for a user who is not in the chat
For Auth0, Clerk, Cognito, Keycloak and Microsoft Entra External ID you can tick “offline access”. When enabled, the provider issues a refresh token that Syncanix stores encrypted, so MCP tools can act as the user without a separate connection step each time. WorkOS SSO cannot issue refresh tokens, so the option is deliberately absent there.