Solutions · AI agents

Agents that act
without your keys.

Give every agent its own identity and a scoped, short-lived token bound to its own key — instead of handing around an API key that does everything and expires never.

Get started Talk to us

A shared API key is not an authorization model.

An agent is a client, not a copy of your credentials.

The default way to give an agent access is to paste in a key that can do everything you can do. Nothing in that key says which agent used it, what it was allowed to do, or how to stop it — so the blast radius of a prompt injection is your entire account.

  • Each agent registers as its own OAuth client with its own credentials and its own scopes.
  • Scopes are constrained to what an agent may call — mcp:*, tool:*, a2a:* — not to your whole API.
  • Revoke one agent without rotating anything else.
  • Every call it makes lands in the audit log against that agent, not against you.
console.oauth.work · agents
The agents screen in the console: three agents, each with its own client id and the tool scopes it may call.

Your MCP server, behind a flow any OAuth client already speaks.

MCP servers need the same thing every API needs: a way for a user to approve what a client may do, and a token that proves it. That is authorization-code flow with dynamic client registration, and it is already a standard.

  • Discovery, dynamic client registration, user consent, and scoped tokens — OAuth 2.1 with PKCE.
  • A hosted demo resource server at /mcp for testing the whole flow end to end before you wire your own.
  • Resource indicators bind a token to the server it was issued for, so it is not replayable elsewhere.

When one agent calls another, the scope narrows.

Multi-agent systems fail closed only if delegation is a first-class operation. Sharing a secret between agents means the second one inherits everything the first had; token exchange means it inherits strictly less.

  • Token exchange with on-behalf-of semantics: an agent swaps its token for a narrower one.
  • Scopes only ever shrink across a hop — there is no path that widens them.
  • The actor chain records who was acting for whom, so the audit trail survives the handoff.

A stolen agent token is a dead token.

Agent tokens end up in logs, in traces, and in model context. The question is not whether one leaks but what an attacker can do with it once it has — and the answer should be nothing.

  • DPoP sender-constrains every token to the agent's own key; a copy without the private key is refused.
  • Tokens expire in minutes, not months.
  • Refresh tokens rotate on use, and replaying one revokes the whole family — theft is detected, not just blocked.
  • Authorization codes are single-use; a replayed code fails closed.
What you get

In the product today.

MCP authorization
OAuth 2.1 · dynamic client registration

Agents authorize against your MCP server with discovery, registration, consent, and scoped tokens.

A2A delegation
token exchange · on-behalf-of

One agent exchanges its token for a narrower one instead of sharing a secret. Scopes only shrink.

Sender-constrained tokens
DPoP · short-lived · audited

Bound to the agent's key and expiring in minutes, so a copied token is inert somewhere else.

Agent audit trail
queryable API · SIEM streaming

Every agent action recorded against that agent, with the actor chain behind it.

Verifiable credentials
VC-JWT · SD-JWT · did:web

Portable, revocable credentials an agent can carry and any verifier can check.

Scoped revocation
per-agent · immediate

Revoke one agent's access without rotating a shared secret every other agent depends on.

Give the agent
its own keys.

Set up a tenant on the free plan in minutes, or read the docs first. No sales call and no demo gate — and a real person on the other end when a procurement review needs one.

Get started Talk to us