Sign-in
SyncPilled checks the tokens of your app's own sign-in provider. Settings for Firebase, Supabase, Auth0, Clerk, Sign in with Apple and any JWKS issuer.
SyncPilled has no sign-in of its own for your app's people. Your app signs
them in with its provider and hands the package a closure that returns a fresh
token; SyncPilled checks the token's signature, issuer, audience and expiry, and
gives the device a SyncPilled token for an hour. The token's sub is the
person.
| Provider | What the console asks for | Issuer and audience |
|---|---|---|
| Firebase Authentication | Project id | https://securetoken.google.com/<project>, the project id |
| Supabase Auth | Project reference | https://<ref>.supabase.co/auth/v1, authenticated |
| Auth0 | Domain and API identifier | https://<domain>/, your API identifier |
| Clerk | Frontend API | https://<frontend api>, any audience |
| Sign in with Apple | Bundle id | https://appleid.apple.com, your bundle id |
| Anything else | Issuer, audience, JWKS URL | As you set them; an empty audience accepts any |
Anonymous accounts
Firebase and Supabase can make an anonymous account on a device without anyone
signing in. Such accounts sync by default. Turn Let anonymous accounts sync
off in an app's settings to refuse them: their sign-in then answers 403 anonymous_not_allowed. An anonymous account lives on one device, so it can't
restore anything elsewhere, and anyone can make many of them.
Deleted accounts
Once a person deletes their account in an app (DELETE /v1/apps/{app}/me, or
from the console), their devices are refused with account_deleted, and so is
every new sign-in for them. The id their provider gave them is never reused.
The Swift package
Connect SwiftData, Core Data or any local store to SyncPilled with a snapshot and an apply function. Files, deletions, accounts and limits.
How sync works
Latest edit wins per record, deletions kept as markers, positions and epochs, and why a device never loses an edit it has not pushed.