> ## Documentation Index
> Fetch the complete documentation index at: https://synthetiq.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How users authenticate and how API routes are protected

## Authentication

Users authenticate via OAuth through the Synthetiq Desktop app or CLI. Sessions are managed automatically by the platform.

## Route protection

API routes are protected based on the user's access level within their organization. Each user is assigned a role, and each role contains a set of scopes that determine which operations the user can perform.

## Scopes

Scopes are the individual permissions that can be assigned to roles within an organization.

| Scope                     | Grants                                             |
| ------------------------- | -------------------------------------------------- |
| `entities:publish`        | Create and manage entities                         |
| `entities:share`          | Share entities with organization members           |
| `entities:share_external` | Share entities with users outside the organization |
| `entities:share_store`    | Publish entities to the organization store         |
| `entities:deploy`         | Deploy entities to production infrastructure       |
| `members:invite`          | Invite new members to the organization             |
| `members:remove`          | Remove members from the organization               |
| `members:manage_roles`    | Assign and change roles for organization members   |
| `org:settings`            | View and edit organization settings                |
| `org:billing`             | Manage organization billing and subscriptions      |