[melvincarvalho]

New page: docs/servers/mas.md, "Matrix Authentication Service (MAS)". It sits in the Servers sidebar after Synapse, and servers/synapse.md gets one sentence linking to it.

What it covers:

• What MAS is, and the legacy and OAuth 2.0 login APIs side by side (spec v1.19).
• When you need it.
• Prerequisites.
• Installing a pinned v1.27.0 binary.
• The minimal MAS config: http, database and matrix.
• Wiring Synapse with matrix_authentication_service, and every setting that conflicts with it.
• nginx for auth.example.com plus the compat routes (login|logout|refresh).
• A systemd unit.
• Migrating with mas-cli syn2mas.
• Admin and registration under MAS: the mas-cli manage commands, registration tokens and the MAS admin API.
• Checks with /auth_metadata, /login, /health and mas-cli doctor.
• A table of common failures.

Versions verified: spec v1.19, Synapse 1.163.0, MAS v1.27.0 (2026-10-13), Element X Android 26.09.4 and Element X iOS 26.10.4.

How each block was checked:

• homeserver.yaml block and conflict list: read from Synapse v1.163.0 synapse/config/mas.py, config/auth.py and config/registration.py (defaults with MAS on), schema/synapse-config.schema.yaml and config_documentation.md. The login, logout and refresh servlets are skipped when MAS is on (rest/client/login.py and logout.py). /_synapse/mas is mounted in rest/synapse/client/__init__.py.
• MAS config excerpt: every key was checked against docs/config.schema.json at v1.27.0. The generated defaults ([::]:8080 bind, issuer, the internal health listener on 8081) were checked against crates/config/src/sections/http.rs.
• CLI: config generate --synapse-config/--output, config check, syn2mas check|migrate --dry-run, the global --config, every manage subcommand and flag, and --version were checked against crates/cli/src/commands/*.rs at v1.27.0. syn2mas exists only as mas-cli syn2mas; there is no standalone tool in the tree at that tag.
• Install: the release asset URLs and the GHCR tag 1.27.0 were checked through the GitHub releases API and the registry manifest API. The container entrypoint was checked in the Dockerfile.
• nginx: the compat route and listener resources come from the MAS docs/setup/reverse-proxy.md. The /login check uses the oauth_aware_preferred: true flow from crates/handlers/src/compat/login.rs.
• Element X: login and sign-up behaviour was checked in source. Android LoginModePresenter.kt and MatrixHomeServerDetails.kt were read at v26.09.4. iOS AuthenticationService.swift and LoginMode.swift were read at release/26.10.4.

Links: every external link returns 200 (curl -sIL). Internal links and anchors pass the build. Gate: 0 findings. Build passes.