AI Agent Identity

Your agents stop sharing an API key and start acting on someone's behalf — with a short-lived credential that records who authorised every action.

Today

{
  "sub": "service-account"
}

With AuthAction

{
  "sub": "ops@acme.eu",
  "act": { "sub": "payouts-agent" },
  "exp": "5 minutes"
}

The person disappears

An AI agent calling your API usually carries a static service credential. It works — but the audit trail records the service, not the person who asked. The agent can do anything that key can do, for anyone, and nothing downstream can tell the difference.

AuthAction trades the user's token for a short-lived one naming both of them. The agent can only do what the person who asked it could already do, and every call it makes says who that was.

Read the guide

How it works

The model never holds a credential. Your MCP server or agent runtime does — and it exchanges the user's token for a scoped one before every call.

1. Someone signs in

Through your existing identity provider — Okta, Entra ID, Google Workspace, or AuthAction itself. Nothing about how your team logs in has to change.

2. The agent exchanges it

One SDK call trades their token for a five-minute credential scoped to a single API, carrying the user as the subject and the agent as the actor.

3. Your API can prove it

Verify it like any other token, then read the delegation chain: who authorised the action, and what carried it out.

One call in your agent

The user's token arrives with the request your MCP server is handling. Exchange it, then call onward.

Built on OAuth 2.0 Token Exchange (RFC 8693)
Works with your existing identity provider
Nested delegation for agents that call subagents
Tokens never outlive the session they came from
EU-hosted, and self-hostable

import { createClient } from '@authaction/node-sdk';

const client = createClient({
  domain:       process.env.AUTHACTION_DOMAIN,
  clientId:     process.env.AUTHACTION_CLIENT_ID,
  clientSecret: process.env.AUTHACTION_CLIENT_SECRET,
});

// userToken arrives with the request you are handling
const { access_token } = await client.exchangeTokenForUser(
  userToken,
  ['https://api.acme.eu'],
);

await fetch('https://api.acme.eu/payouts', {
  headers: { Authorization: `Bearer ${access_token}` },
});

Bring your own provider

Okta Entra ID Google Workspace Auth0 Keycloak

No identity migration

Adopting agent identity does not mean replacing how your people sign in. Register your provider once — issuer and JWKS URL — and the tokens your team already holds can be exchanged directly.

Nothing needs configuring on their side. AuthAction only reads their public keys, outbound. There is no callback URL, client secret, or application to register.

See the setup

Give your agents an identity

Stop handing them a shared key. Start recording who asked. Completely free, no credit card required.

Get Started View Pricing