Connect your users

Apex is auth-agnostic and push-based. It never reaches into your user pool, and it never holds your auth provider's credentials. Instead, you push identity out — and Apex makes your own stable user id the highest-precedence identifier (internal_user_id). Same model as Segment, mParticle, and Amplitude.

That one id is what makes anonymous → known reconciliation deterministic: when the same internal_user_id shows up again, Apex resolves to the exact same Contact in O(1) and stitches the prior anonymous session to it — no fuzzy matching, no shared-device guessing.

Tip

Always identify with your own user id (Cognito sub, Auth0 user_id, Firebase uid, Supabase id, or your DB primary key) — not just an email. Emails change and get shared; your user id is stable and unique. Apex treats internal_user_id as priority-1 (limit one per Contact), exactly like Segment's user_id.

The contract

Every recipe below lands on the same two surfaces:

Browser / client — the SDK identify() call, which carries your user id to POST /api/identity/stitch.
Server / backend — the Server Events API (POST /api/v1/events) with a workspace API key, sending an identify-shaped event whose userId is your stable id.

POST /api/v1/events
x-api-key: apex_sk_...
{
  "events": [
    {
      "type": "user_identified",
      "email": "jane@acme.co",
      "data": { "userId": "<your stable user id>", "plan": "pro" }
    }
  ]
}

Apex indexes userId as internal_user_id, email as a verified email, and reconciles them into one Contact. If two events later arrive for the same internal_user_id, they resolve to the same Contact — deterministically.

Pick your provider

Info

These are copy-paste recipes — one per provider. They all do the same thing: emit an identify event carrying your stable user id when a user signs up or signs in. No proprietary connector to install.

Amazon Cognito — PostConfirmation + PostAuthentication Lambda
Auth0 — post-login Action
Firebase Auth — onCreate Cloud Function + client onAuthStateChanged
Supabase — Auth Hook / database webhook on auth.users
Generic / custom auth — emit from your signup handler, DB trigger, or CDC
Backfill existing users — bring your pre-Apex user base in

How Apex reconciles (what you get for free)

Deterministic merge. Two records that share a verified internal_user_id (or a verified email) auto-merge into one Contact.
Reversible + audited. Every merge is recorded and can be undone from the customer's Identity card. Incumbents make merges permanent — Apex doesn't.
Guardrails. Apex never auto-merges two records with different non-empty user ids, and never merges on device/visitor signals alone (the shared-device trap).
Durable traits. Any traits you send (plan, role, custom fields) persist on the Contact so your segments can target them.