Single-Application Setup

Most SqlOS projects start with one SaaS app. Use single-application mode when you want organizations, users, sessions, SSO, invitations, and permissions without thinking about several OAuth clients up front.

builder.AddSqlOS<AppDbContext>(options =>
{
    options.UseSingleApplication("Todo", app =>
    {
        app.Origin = "https://todo.example.com";
    });
});

This expands into the same seeded client records SqlOS already uses. It does not create a separate runtime path.

Defaults#

Single-application mode also keeps DCR, CIMD, and resource indicators off until you opt into those advanced features.

Overrides#

builder.AddSqlOS<AppDbContext>(options =>
{
    options.UseSingleApplication("Todo", app =>
    {
        app.Origin = "https://todo.example.com";
        app.ClientId = "todo-web";
        app.Audience = "https://todo.example.com/api";
        app.RedirectPath = "/auth/callback";
        app.AllowedScopes = ["openid", "profile", "email", "offline_access", "todos.read", "todos.write"];
        app.EnablePasswordSignup = true;
        app.EnabledCredentialTypes = ["password"];
    });
});

Origin must be an absolute http or https origin without a query string or fragment. RedirectPath must start with /. You can also provide RedirectUris directly when an origin-derived callback is not enough.

Configuration#

Deployment-friendly projects can bind from configuration:

{
  "SqlOS": {
    "Application": {
      "Name": "Todo",
      "Origin": "https://todo.example.com",
      "ClientId": "todo-web",
      "Audience": "https://todo.example.com/api",
      "RedirectPath": "/auth/callback"
    }
  }
}

builder.AddSqlOS<AppDbContext>(options =>
{
    options.UseSingleApplication(builder.Configuration);
});

When to graduate#

Move to explicit multi-application setup when you have more than one app experience, such as a customer portal, an admin console, a CLI, and a partner integration. At that point, use seeded clients or the dashboard to manage each application and use Application Access to control who can use each one.

For the product framing behind the simple path, read Single-Application Mode: WorkOS-Style Defaults Without Giving Up SqlOS.

Audience and application assignment stay separate:

• Audience controls where a token is accepted.
• Application assignment controls who can use an application.