AuthFI documentation

Find the guide for what you are building. Sign people in, give AI agents their own identity and limits, and protect services you already run.

AuthFI is an identity platform for people and AI agents. You work in a project, which is a complete identity provider at one URL, for example https://acme.authfi.io. Your applications sign people in through it, your agents get their own identity and limits from it, and Zero-Code puts its sign-in in front of services you already run.

Everything on these pages is something you can call on your project today.

Start with what you are building

Add sign-in to an app

Sign a person in with OpenID Connect and the authorization code flow. About ten minutes.

Give an AI agent an identity

Connect an agent to tools

Call tools through your project's MCP gateway.

How Zero-Code works

Put sign-in and access rules in front of services on Kubernetes, with nothing added to them.

Browse by product area

Start here

The ideas and terms every other page builds on.

Projects and issuers

What a project is, and how a client finds its endpoints and keys from one URL.

Roles, groups and grants

The four things every access decision is made from.

Glossary

The terms these pages use, each in a sentence or two.

Applications

Sign people and services in to the software you build or buy.

Application types and redirect URIs

Choose the type that matches where your code runs, and see how a redirect URI is matched.

Manage sessions, sign-out and MFA

Keep a person signed in, sign them out, and require multi-factor authentication.

Get an access token for a backend service

Get an access token for a backend service that has no person to sign in.

Connect a SAML application

Use your project as the identity provider for the applications your staff use.

Connections

Bring in people who already have an account somewhere else.

Add sign-in with another identity provider

Google, Microsoft, Okta, GitHub, GitLab, or any OpenID Connect or SAML provider.

Provision people with SCIM

Keep accounts in step with your directory, in and out.

AI agents

Give each agent its own identity, limit what it may do, and put a person in the loop.

How agent sign-in works

The model, from registration to an approved action, and the standard behind each step.

Limit what an agent may do

Capabilities, limits on their arguments, and rules that ask a person.

Ask before a sensitive action

Bind a token to one action and wait for a person when a rule requires one.

Ask a named person to approve

Have one person approve on their own device, and receive a token that names them.

The MCP gateway

A grant per tool, and credentials the agent never sees.

Accept agents at your own API

Validate an agent's access token in your service.

Revoke an agent

Revoke an agent, and have your services told when it happens.

Zero-Code

Sign-in and access rules for services on Kubernetes, decided on the node.

How Zero-Code works

The three steps every workload goes through: Observe, Classify and Protect.

Install Zero-Code on a cluster

Connect a cluster with one Helm command.

Protect a web app

Put your project's sign-in in front of a service people open in a browser.

Protect an API

Require an access token issued for that API, with rules for each route.

How enforcement works

What is decided on the node, and the boundary around an AI agent.

Check compliance and apply the rules that close it

Score a cluster against published frameworks and apply the fix with built-in admission or Kyverno.

Access

Reach servers and cloud accounts with credentials that last minutes.

Set up server access with SSH certificates

SSH certificates that last five minutes.

Grant cloud roles without stored keys

Assume an AWS role with your AuthFI identity.

Security

The keys your project signs with, and the record of everything that happened.

Keys and secrets

The keys a project has, what happens when one rotates, and how secrets are kept.

Use the audit record

Search it, send it to your log tools, and see that it was not altered.

Extend

Connect your own code to what happens in your project.

Receive webhooks

Have your project call your server when something happens.

Run actions at sign-in

Run your own rules while a person signs in, and add claims to their tokens.

Reference

Every endpoint, token and error, for looking things up.

OAuth and OpenID Connect endpoints

Each parameter and response of each endpoint an application calls.

Discovery documents

The documents a project publishes about itself.

Tokens and claims

What each kind of token is for, how long it lasts and what it carries.

Errors

How errors are shaped, and what each code means.

How these pages are written

Every URL is real. Examples use a project called acme. Replace acme.authfi.io with your own project's issuer and they run.
Standards are named. Where AuthFI implements a published standard, the page says which one, so any library for that standard works.
Every page is checked against the product. What a page describes is what your project does.

For AI assistants

Every page is also available as plain Markdown: add .md to its URL. The list of all pages is at llms.txt.