AuthPI — home
Product Docs Pricing Company
Sign in Start your 60-day trial

For teams building B2B SaaS, developer platforms, and AI products

Authenticate users, services, and AI agents with one API.

Add customer organizations, sign-in, and scoped API access through a shared identity model. Give each agent its own credentials and audit trail.

No credit card required. All core features included. See pricing.

OAuth 2.0 OIDC JWT/JWKS WebAuthn CloudEvents OpenAPI TypeScript and Python SDKs

How the model works

One identity model for people and code.

An issuer brings users, services, and agents into one identity system. Organizations group each customer's members and access rules.

Explore the identity model
your identity system
Your app sign-in and API access authenticate Issuer · your identity boundary Users people signing in Organization your customers and teams AI agents independent identities Services code calling your APIs member member identity events Workflows connected by webhooks

Agent identity

Control and audit each agent independently.

Give each agent its own credentials, scoped tokens, and identity events. For example, support-triage gets tickets:read; your API checks that scope before returning tickets.

Agent credentials and lifecycle

Your customer model

Onboard each customer with their own members and access rules.

Create a customer organization with invitations and membership scopes. Give Jane billing:read in Acme, for example; your API checks her Acme membership and scope before returning its invoices.

Organization memberships and lifecycle

Example membership

Organization
Acme
Member
Jane
Scope
billing:read

Sign-in, on open standards

Let users sign in their way.

Offer familiar sign-in options, from social accounts to enterprise SSO, with passkeys and multi-factor authentication for added protection.

Social logins

Google, GitHub, Microsoft, Apple. Users sign in with accounts they already have.

Enterprise SSO

Connect Okta, Azure AD, or any OIDC provider. Your enterprise customers expect it.

Passkeys

Phishing-resistant sign-in backed by platform authenticators.

Magic links

One click in their inbox, they're signed in. Simple, secure, no password to forget.

Passwords

Password sign-in with breach checks and strength requirements.

Two-factor auth

TOTP codes from any authenticator app, plus backup codes for recovery.

Connecting backend services or user-owned scripts? Choose credentials for each caller.

Session protection

Session protection built in

Rotating refresh tokens and reuse detection protect each session. Track devices and configure timeouts, with events to connect security changes to your workflows.

Refresh token reuse detection

Refresh tokens rotate on every use. Reusing a rotated token revokes its session and stops further refreshes.

Device tracking

Sessions record device information for review. Device-fingerprint enforcement on refresh is a separate, opt-in client setting.

Session timeouts

Idle timeouts, absolute lifetimes, or activity-based extension. Your policy, enforced automatically by the issuer.

Session revocation

Revoke sessions and stop token refresh immediately. Existing access tokens remain valid until their configured expiry, 30 minutes by default.

Configure and handle OIDC backchannel logout to clear your application's own sessions. Read the session and logout guide.

a stolen refresh token is replayed automatic response
  1. Reuse detected

    An already-rotated refresh token is presented a second time.

  2. Session terminated

    s_01j5k8m9n2 is revoked and refresh stops. Already-issued access tokens remain valid until expiry.

  3. EVENT session.compromised

    Delivered to your webhook with the session and user in the payload, ready for your incident tooling.

API, SDKs, and docs

Keep identity management in your product code.

Everything AuthPI does is reachable through the API, wrapped in typed SDKs for TypeScript and Python, and documented for you and for the coding agents working alongside you.

import { AuthPIAdmin } from "@authpi/admin";

const admin = new AuthPIAdmin({
  apiKey: { id: process.env.AUTHPI_KEY_ID!, secret: process.env.AUTHPI_KEY_SECRET! },
  accountId: process.env.ACCOUNT_ID!,
});
const iss = admin.issuer(process.env.ISSUER_ID!);

// A customer and an agent, three calls.
const org = await iss.organizations.create({ name: "Acme", org_type: "business" });

const agent = await iss.agents.create({
  name: "Support triage agent",
  scopes: ["tickets:read", "tickets:triage"],
});

await iss.agent(agent.id).verifiers.create({ type: "secret", name: "primary" });

// The agent authenticates with standard client_credentials at runtime.
from authpi_admin import AuthPIAdmin

async with AuthPIAdmin(api_key=(KEY_ID, KEY_SECRET), account_id=ACCOUNT_ID) as admin:
    iss = admin.issuer(ISSUER_ID)

    # A customer and an agent, three calls.
    org = await iss.organizations.create({"name": "Acme", "org_type": "business"})

    agent = await iss.agents.create({
        "name": "Support triage agent",
        "scopes": ["tickets:read", "tickets:triage"],
    })

    await iss.agent(agent.id).verifiers.create({"type": "secret", "name": "primary"})

    # The agent authenticates with standard client_credentials at runtime.

Real @authpi/admin · authpi-admin calls generated from the Core API schema.

Events and webhooks

Connect identity changes to provisioning and incident workflows.

Subscribe to CloudEvents with optional HMAC signing, automatic retries, and recorded attempts. For example, your handler can provision Acme's workspace access when organization.membership.created arrives.

Delivery log last 5
user.created
evt_01J5K8M9N2 attempt 1/1 ✓ delivered
organization.membership.created
evt_01K7N3P5R8 attempt 1/1 ✓ delivered
session.compromised
evt_01M9Q2S5U8 attempt 2/3 retrying
api-key.created
evt_01N2R5T8V1 attempt 1/1 ✓ delivered
organization.invitation.accepted
evt_01P4T7W0Y3 attempt 1/1 ✓ delivered
user.created authpi-signature verified
 
Delivery
Persisted attempts
Auth
Bearer or HMAC
Attempts
40 by default
Format
CloudEvents 1.0

Runtime and data

Global authentication.
Regional identity storage.

User profiles, credentials, and sessions stay with their assigned identity store from creation. Authentication uses that same region. AuthPI operates the regional infrastructure for you.

  • Stand up regional infrastructure
  • Replicate the user store

One issuer, eight regional identity stores.

The two European stores enforce EU jurisdiction. Placement in the other six regions is best-effort. Review the placement guarantees and creation controls for your residency requirements.

Read how the global identity mesh works

Use cases

Three products this was built around

From a single API to a multi-party platform, the same primitives model people, services, and AI agents.

API-first SaaS

Multi-Tenant

Your product is an API whose customers are companies. Organizations, memberships, and scoped keys are built-in primitives, so you add multi-tenancy in days, not quarters.

  • Organizations & memberships
  • Domain auto-join onboarding
  • Webhook-driven provisioning
  • Org-scoped API keys

Developer platforms

Multi-Party

You host other people's services and integrations. Dedicated identity per tenant, machine-to-machine auth, and per-party event routing with full isolation.

  • One issuer per tenant
  • M2M credentials built in
  • Events routed per party
  • Complete data isolation

AI-native products

Human + Machine

People and agents both call your API. Give each AI agent its own identity, scopes, organization membership, and audit trail instead of borrowing a user account or sharing an API key.

  • First-class agent IDs
  • Five-minute agent tokens
  • Per-agent secret credentials
  • Agent audit events

Get started

One API. Every identity. Start with a 60-day trial.

Create an account, grab your API keys, and model users, organizations, services, and agents in one system.

No credit card required. All core features included. See pricing.