Authdog
Log In

AgentSec

Security for the agents doing the work

Authenticate agents into your apps with a revocable identity, and govern what they call with a per-agent trust store. One owner, one identity, one revoke switch.

Agents sign in like users do
The browser OIDC code flow with a key the agent owns. No shared secrets.
Scope every tool call
Allowed tools, scopes, and origins per agent in the environment trust store.
One-click revocation
New sign-ins and new tokens stop immediately. Owners stay accountable.

Pick your plan

No credit card required. Change plans any time from Plan & Billing.

← Full pricingContinue on Free →

Authentication for agents

Agents sign in the way people do

Agent Sign-In gives an agent what a person gets from your login page: an identity it owns, the standard browser OIDC code flow, and an owner who can cut it off. Your app adds two config values — no registration, no client secret.

Two config values

Your https origin is the client_id and a same-site redirect URI is the callback. PKCE S256 is mandatory; there is no secret to leak.

Keys the agent owns

A P-256 key generated on the agent's side — in its browser, or as a key file its own runtime signs with. The private half never touches a server.

Standard OIDC claims

id_token and access token carry sub, email, name, and actor_type: agent — the token validation your app already runs works unchanged.

Remembered approvals

The owner approves an app once; repeat sign-ins are zero-interaction on a 180-day sliding window.

Access control for agents

Every caller registered, scoped, and audited

The Agents module registers every non-human caller in your environment's trust store: verified subjects, allowed scopes, allowed tools, and a revoke switch.

Register and verify

Provision an OIDC client, or register an existing client ID, SPIFFE ID, or URI as a verified trust-store subject.

Allowed tools and scopes

Glob-scoped tool lists per agent, with manifest pinning that fires when a live MCP tool list drifts from what you approved.

Revoke is a kill switch

One click stops new tokens at the issuer. Outstanding tokens live out their documented minutes, not forever.

Per-agent activity

Every tool invocation, denial, and trust violation lands in the environment audit trail filtered by subject.

Lifecycle and detection

Delegation without impersonation, detection without guesswork

Agents acting on a user's behalf carry an explicit act chain, and Lidar watches the identity stream for the attacks that target them.

Token exchange, not impersonation

RFC 8693 delegation with a nested act chain and optional identity assertions — the resource always sees who is acting for whom.

Lidar threat detection

Monitors correlate agent-tool abuse, injection, and MCP rug-pulls on the same event stream as your human traffic.

One audit trail

Authentication events and tool activity land in the same environment audit log — actor type included.

Free trial

Request a free trial

Tell us what you're building and we'll get you set up with a trial, plus someone who can answer questions as you evaluate.

  • Full access to the platform while you evaluate it
  • Help wiring it into your stack from someone who knows it
  • Answers on SSO, SCIM, residency, and compliance requirements

We'll only use this to contact you about Authdog.

01

Integrate

Connect one SDK or API to your application.

02

Configure

Choose policies and capabilities for each environment.

03

Enforce

Ship globally with identity controls at the edge.

Stop building a second product
just to log people in.

Sign-in, access, and the audit trail — so you can get back to the actual app.

Request a trial