Solutions · Platform teams

One identity layer.
Not three.

Human sign-in, enterprise federation, and agent authorization usually arrive as three separate systems with three separate failure modes. They are one problem, and they should be one layer.

Get started Talk to us

Every identity system you run is one more you have to be right about.

The same issuer for people, companies, and agents.

Consumer sign-in, enterprise SSO, and machine access tend to be bolted together from different tools, each with its own session model and its own idea of what a token means. Reconciling them is where the bugs live.

  • One OIDC provider issuing for end users, federated enterprise users, and agents alike.
  • One organization and role model that tokens carry, whatever the login route was.
  • One audit log, so a question about access has one place to be answered.

One customer's configuration can never reach another's.

Multi-tenancy done as a column on a row is a single query away from a cross-tenant leak. Doing it as a separate issuer per customer makes the isolation structural rather than something every future query has to remember.

  • Every customer is a self-contained issuer at their own subdomain, with its own discovery document and JWKS.
  • Each tenant gets its own Ed25519 signing key, envelope-encrypted at rest.
  • Tokens issued on a tenant host are signed by that tenant's key, so an issuer mix-up fails verification.
  • Rotate a tenant's key without invalidating anything that was correctly issued before it.

Standard OIDC. No proprietary SDK.

The cost of an identity vendor is rarely the invoice; it is how much of your codebase learns their vocabulary. A layer you can leave is a layer you can also adopt incrementally.

  • The same authorization-code flow you would run against any OIDC provider — discovery, JWKS, PKCE.
  • Your data and your tenant configuration export through the management API.
  • Nothing bespoke to adopt, and nothing to unpick if you ever leave.

The things you would otherwise be paged about.

An identity layer is judged on its worst day. These are the properties that decide what that day looks like, and each one is testable against the running system rather than asserted in a datasheet.

  • Authorization codes are single-use; a replayed code fails closed.
  • Refresh tokens rotate on use, and reuse revokes the whole family.
  • Passkey registrations are verified end to end — attestation and relying-party ID checked, not assumed.
  • A live health check, and audit streaming into the SIEM you already watch.
What you get

In the product today.

Multi-tenancy
one isolated issuer per customer

A self-contained issuer per tenant, with its own discovery document, JWKS, DID, and signing key.

Per-tenant keys
Ed25519 · envelope-encrypted at rest

Each org's private key is encrypted under a master key and rotatable without breaking old verifications.

Single Sign-On
OIDC · OAuth 2.1 · PKCE

A standards-compliant provider your app integrates with the way it would any other.

Management API
org-scoped keys · full export

Provision tenants, rotate keys, and export everything — the console is a client of the same API.

Audit logs & streaming
queryable API · Datadog · Splunk · HTTPS

One record of every privileged action, streamable to the system your security team already watches.

Agent authorization
MCP · A2A · DPoP

The same layer issues scoped, revocable, sender-constrained tokens to the agents acting for your users.

Run one layer.
Not three.

Set up a tenant on the free plan in minutes, or read the docs first. No sales call and no demo gate — and a real person on the other end when a procurement review needs one.

Get started Talk to us