generated: '2026-08-29'
method: searched
source: https://support.syncari.com/hc/en-us/articles/18707594686100-Authenticating-with-Syncari-Embed-APIs
name: Syncari authentication profile
description: >-
  Syncari runs two independent OAuth 2.0 surfaces. The Syncari Embed REST API uses the client-credentials grant
  against a token endpoint on the API host itself; the hosted MCP server uses the authorization-code grant with
  PKCE and RFC 7591 dynamic client registration against an authorization server on app.syncari.com. Both issue
  Bearer tokens carried in the Authorization header. Derived from Syncari's own documentation plus a live probe of
  the MCP OAuth metadata - no OpenAPI securitySchemes exist because Syncari publishes no machine-readable contract.
docs:
- https://support.syncari.com/hc/en-us/articles/18707594686100-Authenticating-with-Syncari-Embed-APIs
- https://support.syncari.com/hc/en-us/articles/4417399957908-Set-Up-an-API-User
- https://support.syncari.com/hc/en-us/articles/18707238885780-Using-the-Syncari-Embed-APIs
schemes:
- id: syncari_embed_oauth2_client_credentials
  api: Syncari Embed API
  type: oauth2
  flow: clientCredentials
  token_endpoint: https://api.syncari.com/api/v1/oauth/token
  token_endpoint_method: POST
  content_type: application/x-www-form-urlencoded
  credential_transport: query parameters (grant_type, client_id, client_secret)
  bearer_format: JWT
  token_type: Bearer
  token_lifetime_seconds: 10800
  token_lifetime_note: Tokens remain active for three hours; after three hours the token must be refreshed.
  refresh:
    supported: true
    grant_type: refresh_token
    endpoint: https://api.syncari.com/api/v1/oauth/token
    note: >-
      The client-credentials response also returns a refresh_token, which is unusual for that grant. Syncari
      documents exchanging it at the same endpoint with grant_type=refresh_token plus client_id and client_secret.
  response_fields: [access_token, refresh_token, token_type, expires_in]
  request_header: 'Authorization: Bearer <access_token>'
  scopes_documented: false
  credential_provisioning:
    where: Syncari app, Settings > Users > Invite User, with the "API Access" checkbox ticked
    docs: https://support.syncari.com/hc/en-us/articles/4417399957908-Set-Up-an-API-User
    notes:
    - An API user cannot log in to the Syncari web app and receives no invitation email.
    - An existing interactive user cannot be converted into an API user.
    - Client ID and client secret are shown once at creation and cannot be retrieved afterwards.
    - Rotation is delete-and-recreate the API user; there is no documented key-rotation endpoint.
  authorization_model:
    style: role and instance scoped, enforced by the API user's assignment
    roles:
    - name: Org Admin
      grants: Manage all instances in the subscription, create new instances and new users.
    - name: Instance Admin
      grants: Manage a single Syncari instance. One API user per instance is the documented pattern.
    custom_roles: >-
      A Role API (GET/POST/PATCH/DELETE /api/v1/roles, plus /api/v1/users/{userId}/roles/{roleId}) was added in the
      June 2026 release for programmatic management of custom roles and role assignments.
    additional: >-
      Attribute Based Access Control (ABAC) is documented as a platform feature for row/field-level access inside
      an instance.
- id: syncari_mcp_oauth2_authorization_code
  api: Syncari MCP Server
  type: oauth2
  flow: authorizationCode
  method: probed
  source: https://mcp.syncari.com/.well-known/oauth-authorization-server
  issuer: https://mcp.syncari.com
  authorization_endpoint: https://app.syncari.com/arcade/api/v1/oauth2/authorize
  token_endpoint: https://app.syncari.com/arcade/api/v1/oauth2/token
  registration_endpoint: https://app.syncari.com/arcade/api/v1/oauth2/register
  grant_types: [authorization_code, refresh_token]
  response_types: [code]
  response_modes: [query]
  token_endpoint_auth_methods: [client_secret_basic, client_secret_post, none]
  pkce_methods: [plain, S256]
  dynamic_client_registration: true
  bearer_methods_supported: [header]
  scopes_supported: []
  challenge: >-
    An unauthenticated POST to https://mcp.syncari.com/mcp returns 401 with
    WWW-Authenticate: Bearer error="invalid_token", resource_metadata="https://mcp.syncari.com/.well-known/oauth-protected-resource"
    - a correct RFC 9728 implementation.
  consent: >-
    Syncari's Claude setup documentation shows a "Syncari MCP Authorization Request" screen listing the permissions
    being requested, so a consent surface exists even though no scope names are published.
platform_connector_auth:
  note: >-
    Separate from calling Syncari, the platform authenticates OUT to source systems. The Synapse SDK enumerates the
    supported outbound auth types, which is the auth vocabulary a custom connector must implement.
  source: https://support.syncari.com/hc/en-us/articles/25947440030356-Models-Reference-Page
  types:
  - id: UserPasswordToken
    label: Basic authentication (user, password, security token)
  - id: UserPassword
    label: Username and password
  - id: ApiKey
    label: API key or single access token
  - id: Oauth
    label: OAuth 2.0 with iFrame authorization flow
  - id: SimpleOAuth
    label: OAuth 2.0 client credentials, or any scheme whose credentials expire and must be re-requested
  sso:
    supported: true
    docs: https://support.syncari.com/hc/en-us/sections/50437274435732-Single-Sign-On-SSO
    note: Syncari documents Single Sign-On for interactive users; it is not a path for API access.
gaps:
- No published OAuth scope vocabulary for either surface.
- No mTLS, no OpenID Connect discovery document (mcp.syncari.com/.well-known/openid-configuration returns 404).
- No documented programmatic credential rotation; secrets are shown once and rotation means recreating the API user.