For teams building B2B SaaS, developer platforms, and AI products
Authenticate users, services, and AI agents with one API.
Add customer organizations, sign-in, and scoped API access through a shared identity model. Give each agent its own credentials and audit trail.
No credit card required. All core features included. See pricing.
How the model works
One identity model for people and code.
An issuer brings users, services, and agents into one identity system. Organizations group each customer's members and access rules.
Explore the identity modelAgent identity
Control and audit each agent independently.
Give each agent its own credentials, scoped tokens, and identity events. For example, support-triage gets tickets:read; your API checks that scope before returning tickets.
Agent credentials and lifecycle-
Agent starts a work cycle
support-triage needs tickets:read
-
Mints a scoped token
POST /i_4r8w2k9m5x1p7q/token · client_credentials
{ "expires_in": 300, "scope": "tickets:read" }token lifetime · 5 min -
Calls your API
GET /tickets · Authorization: Bearer …
200 OK · JWT verified against your issuer's JWKS -
Expires five minutes later
expiredno refresh token exists · next cycle mints fresh
Your customer model
Onboard each customer with their own members and access rules.
Create a customer organization with invitations and membership scopes. Give Jane billing:read in Acme, for example; your API checks her Acme membership and scope before returning its invoices.
Organization memberships and lifecycleExample membership
- Organization
- Acme
- Member
- Jane
- Scope
- billing:read
Sign-in, on open standards
Let users sign in their way.
Offer familiar sign-in options, from social accounts to enterprise SSO, with passkeys and multi-factor authentication for added protection.
Social logins
Google, GitHub, Microsoft, Apple. Users sign in with accounts they already have.
Enterprise SSO
Connect Okta, Azure AD, or any OIDC provider. Your enterprise customers expect it.
Passkeys
Phishing-resistant sign-in backed by platform authenticators.
Magic links
One click in their inbox, they're signed in. Simple, secure, no password to forget.
Passwords
Password sign-in with breach checks and strength requirements.
Two-factor auth
TOTP codes from any authenticator app, plus backup codes for recovery.
Connecting backend services or user-owned scripts? Choose credentials for each caller.
Session protection
Session protection built in
Rotating refresh tokens and reuse detection protect each session. Track devices and configure timeouts, with events to connect security changes to your workflows.
Refresh token reuse detection
Refresh tokens rotate on every use. Reusing a rotated token revokes its session and stops further refreshes.
Device tracking
Sessions record device information for review. Device-fingerprint enforcement on refresh is a separate, opt-in client setting.
Session timeouts
Idle timeouts, absolute lifetimes, or activity-based extension. Your policy, enforced automatically by the issuer.
Session revocation
Revoke sessions and stop token refresh immediately. Existing access tokens remain valid until their configured expiry, 30 minutes by default.
Configure and handle OIDC backchannel logout to clear your application's own sessions. Read the session and logout guide.
-
Reuse detected
An already-rotated refresh token is presented a second time.
-
Session terminated
s_01j5k8m9n2is revoked and refresh stops. Already-issued access tokens remain valid until expiry. -
EVENT session.compromised
Delivered to your webhook with the session and user in the payload, ready for your incident tooling.
API, SDKs, and docs
Keep identity management in your product code.
Everything AuthPI does is reachable through the API, wrapped in typed SDKs for TypeScript and Python, and documented for you and for the coding agents working alongside you.
Full CRUD for every resource in the model, defined in OpenAPI 3.1. Cursor pagination, idempotency keys, and conditional requests throughout.
Browse the API reference@authpi/admin and @authpi/idp for TypeScript, authpi-admin and authpi-idp for Python. Typed end to end, generated from the same spec.
Pick your SDKNext.js, SvelteKit, Hono, Workers, agents, and more, plus concepts and reference pages. llms.txt included, so coding agents read the same docs you do.
Open the docsimport { AuthPIAdmin } from "@authpi/admin";
const admin = new AuthPIAdmin({
apiKey: { id: process.env.AUTHPI_KEY_ID!, secret: process.env.AUTHPI_KEY_SECRET! },
accountId: process.env.ACCOUNT_ID!,
});
const iss = admin.issuer(process.env.ISSUER_ID!);
// A customer and an agent, three calls.
const org = await iss.organizations.create({ name: "Acme", org_type: "business" });
const agent = await iss.agents.create({
name: "Support triage agent",
scopes: ["tickets:read", "tickets:triage"],
});
await iss.agent(agent.id).verifiers.create({ type: "secret", name: "primary" });
// The agent authenticates with standard client_credentials at runtime. from authpi_admin import AuthPIAdmin
async with AuthPIAdmin(api_key=(KEY_ID, KEY_SECRET), account_id=ACCOUNT_ID) as admin:
iss = admin.issuer(ISSUER_ID)
# A customer and an agent, three calls.
org = await iss.organizations.create({"name": "Acme", "org_type": "business"})
agent = await iss.agents.create({
"name": "Support triage agent",
"scopes": ["tickets:read", "tickets:triage"],
})
await iss.agent(agent.id).verifiers.create({"type": "secret", "name": "primary"})
# The agent authenticates with standard client_credentials at runtime.
Real @authpi/admin · authpi-admin calls generated from the Core API schema.
Events and webhooks
Connect identity changes to provisioning and incident workflows.
Subscribe to CloudEvents with optional HMAC signing, automatic retries, and recorded attempts. For example, your handler can provision Acme's workspace access when organization.membership.created arrives.
Runtime and data
Global authentication.
Regional identity storage.
User profiles, credentials, and sessions stay with their assigned identity store from creation. Authentication uses that same region. AuthPI operates the regional infrastructure for you.
- Stand up regional infrastructure
- Replicate the user store
One issuer, eight regional identity stores.
The two European stores enforce EU jurisdiction. Placement in the other six regions is best-effort. Review the placement guarantees and creation controls for your residency requirements.
Read how the global identity mesh workssignup · lagos (LOS) → weur · eu jurisdiction, enforced
Use cases
Three products this was built around
From a single API to a multi-party platform, the same primitives model people, services, and AI agents.
API-first SaaS
Multi-TenantYour product is an API whose customers are companies. Organizations, memberships, and scoped keys are built-in primitives, so you add multi-tenancy in days, not quarters.
- Organizations & memberships
- Domain auto-join onboarding
- Webhook-driven provisioning
- Org-scoped API keys
Developer platforms
Multi-PartyYou host other people's services and integrations. Dedicated identity per tenant, machine-to-machine auth, and per-party event routing with full isolation.
- One issuer per tenant
- M2M credentials built in
- Events routed per party
- Complete data isolation
AI-native products
Human + MachinePeople and agents both call your API. Give each AI agent its own identity, scopes, organization membership, and audit trail instead of borrowing a user account or sharing an API key.
- First-class agent IDs
- Five-minute agent tokens
- Per-agent secret credentials
- Agent audit events
Get started
One API. Every identity. Start with a 60-day trial.
Create an account, grab your API keys, and model users, organizations, services, and agents in one system.
No credit card required. All core features included. See pricing.