Ship the single sign-on, directory sync, RBAC, and audit logs your enterprise customers ask for — and scoped, revocable authorization for the agents acting on their behalf. One API, one flat price, every connection included.
Onboard one enterprise customer or a thousand — the shape of the bill doesn't change. Every tenant, every SSO connection, and every agent is in the price. Your data and your tenant configuration export through the management API, so nothing here is built to trap you.
Your users approve exactly what an agent may do. The agent gets a scoped, short-lived token bound to its own key — and you can revoke it whenever you want.
Agents authorize against your MCP server with the flow any OAuth client uses: discovery, registration, user consent, scoped tokens. Our hosted /mcp is a demo resource server for testing the whole flow end to end.
When one agent hands work to another, it exchanges its token for a narrower one instead of sharing a secret. Scopes only ever shrink, and the actor chain records who was acting for whom.
Every agent token is sender-constrained to that agent's key and expires in minutes. A copied token is inert somewhere else, and every call it makes lands in the audit log.
In the product today — not on a roadmap, and not behind a quote.
A standards-compliant OIDC provider your app integrates with the way it would any other: discovery, JWKS, refresh-token rotation, and social sign-in with Google, Microsoft, and GitHub.
Connect a customer's identity provider and their whole company signs in. SAML assertions are verified signature by signature, and IdP-initiated logins resolve back to the right connection.
New hires appear, leavers are deprovisioned, and group membership stays in step with your customer's directory. Deprovisioning ends live sessions on the next request, not at token expiry.
A hosted portal where your customer's IT admin configures SSO and SCIM, verifies their domain over DNS, and rotates their SAML signing certificate — without a ticket in your support queue.
Every user belongs to an organization, and tokens carry the organization and the roles with them. Define permissions once and enforce them across the API and the management plane.
Passwordless sign-in with a passkey, TOTP with recovery codes, email codes, and magic links. Passkey registrations are verified end to end — the authenticator is checked, not taken on trust.
Every privileged action lands in a tenant-scoped audit log you can query and export — and stream to Datadog, Splunk HEC, or any HTTPS collector in that destination's native format.
Subscribe to the events you care about and get signed, retried delivery with backoff. Prefer to pull? The events API hands back the same stream behind a cursor.
Issue credentials your users and agents can carry anywhere and any verifier can check. Revoke one and the status list reports it revoked on the next verification.
Every customer you onboard is a self-contained issuer at their own subdomain — acme.oauth.work — with its own discovery document, JWKS, DID, settings, and Ed25519 signing key. Tokens issued on a tenant host are signed by that tenant's key, so one customer's configuration can never reach another's.
One command creates a tenant. Your app runs the same authorization-code flow it would run against any OIDC provider — so there's nothing bespoke to adopt, and nothing to unpick if you ever leave.
Read the docs# Authorize a user GET /authorize ?response_type=code &client_id=acme-web &code_challenge=<S256> &scope=openid
Set up a tenant on the free plan in minutes, or read the docs first. Either way, no sales call and no demo gate.