Guides
Guides
Production tasks to complete after the SqlOS quickstarts.
Complete a quickstart first#
Run the Todo sample
Fastest runnable proof.
Add SqlOS to one app
Canonical UseSingleApplication setup.
Sign in from ASP.NET Core
Framework-owned PKCE, callback, and cookie session.
Protect an API
Audience-aware bearer validation.
Authorize EF queries
SQL-backed row filtering.
Authentication and identity#
Password login
Add hosted password auth to an existing ASP.NET app.
Auth branding
Apply one product identity to hosted login, signup, and built-in auth email.
Custom login UI
Render your own screens while SqlOS owns OAuth and auth state.
Email-code onboarding
Create a passwordless account with a short-lived inbox code.
SMS sign-in for mobile
Build passwordless native auth with phone codes and PKCE.
Social sign-in for mobile
Open a system auth session and return through a verified app link.
Invite teammates
Keep organization membership behind expiring email invitations.
Account recovery and devices
Reset a password, review sessions, and safely revoke devices.
Social sign-in
Configure Google, Microsoft, GitHub, Apple, or custom login.
GitHub sign-in
Create the GitHub OAuth App and enable the provider.
Authenticator MFA
Enable TOTP, recovery codes, and tenant-required MFA.
SAML SSO for an organization
Connect Entra or another SAML identity provider.
Customer-managed SSO
Let each customer IT admin configure one organization's SAML connection.
SCIM directory sync
Provision users and groups from an enterprise IdP into AuthServer and FGA.
SCIM with Microsoft Entra
Map identity attributes, provision on demand, and roll out assigned users and groups.
SCIM with Okta
Configure user lifecycle, assignments, and Group Push for an Okta app integration.
SCIM plus SAML
Keep SCIM authoritative for access while SAML authenticates provisioned members.
Standalone identity server
Run one SqlOS auth host for several application surfaces.
Terminal sign-in
Authenticate a CLI through the browser with device authorization.
Authorization and operations#
Background jobs with service accounts
Authorize non-user workers with rotated app-owned credentials.
FGA groups
Grant a role once to a team and resolve inherited access for every member.
Multi-app access
Assign organizations to the clients they are allowed to open.
OAuth for MCP clients
Protect an MCP server with resource indicators and portable clients.
Model FGA
Design a multi-tenant resource hierarchy.
Connect memberships to FGA
Reconcile organization roles into tenant-scoped grants without leaving stale access.
Filter EF queries
Compose authorization into a LINQ WHERE clause.
Audit logs
Record application events and review them in the dashboard.
Transactional email
Create, preview, send, retry, and inspect application-owned email.
Calendar integration
Connect Google Calendar or Microsoft 365.
Configuration
Review service registration, dashboard, and client modes.
Production readiness
Harden public URLs, proxies, keys, schema rollouts, backups, and health gates.
Test your integration
Prove your own OAuth, SQL, tenant, grant, and revocation boundaries.
Contribute to SqlOS
Run the repository's unit, integration, docs, and coverage checks.
Troubleshooting
Diagnose common setup, OAuth, SAML, and SQL issues.
Use SDK Reference and HTTP API Reference for exact contracts after selecting a task.