# AuthFI documentation

Find the guide for what you are building. Sign people in, give AI agents their own identity and limits, and protect services you already run.

AuthFI is an identity platform for people and AI agents. You work in a project, which is a complete identity provider at one URL, for example `https://acme.authfi.io`. Your applications sign people in through it, your agents get their own identity and limits from it, and Zero-Code puts its sign-in in front of services you already run.

Everything on these pages is something you can call on your project today.

## Start with what you are building

<Cards>
  <Card href="/quickstart/sign-in" title="Add sign-in to an app">
    Sign a person in with OpenID Connect and the authorization code flow. About ten minutes.
  </Card>
  <Card href="/quickstart/agent" title="Give an AI agent an identity">
    Register an agent, sign in with its own key, and get a 15-minute access token.
  </Card>
  <Card href="/quickstart/mcp" title="Connect an agent to tools">
    Call tools through your project's MCP gateway.
  </Card>
  <Card href="/zero-code/overview" title="How Zero-Code works">
    Put sign-in and access rules in front of services on Kubernetes, with nothing added to them.
  </Card>
</Cards>

## Browse by product area

### Start here

The ideas and terms every other page builds on.

<Cards>
  <Card href="/concepts/projects" title="Projects and issuers">
    What a project is, and how a client finds its endpoints and keys from one URL.
  </Card>
  <Card href="/concepts/access" title="Roles, groups and grants">
    The four things every access decision is made from.
  </Card>
  <Card href="/glossary" title="Glossary">
    The terms these pages use, each in a sentence or two.
  </Card>
</Cards>

### Applications

Sign people and services in to the software you build or buy.

<Cards>
  <Card href="/applications/types" title="Application types and redirect URIs">
    Choose the type that matches where your code runs, and see how a redirect URI is matched.
  </Card>
  <Card href="/applications/sessions" title="Manage sessions, sign-out and MFA">
    Keep a person signed in, sign them out, and require multi-factor authentication.
  </Card>
  <Card href="/applications/machine-to-machine" title="Get an access token for a backend service">
    Get an access token for a backend service that has no person to sign in.
  </Card>
  <Card href="/applications/saml" title="Connect a SAML application">
    Use your project as the identity provider for the applications your staff use.
  </Card>
</Cards>

### Connections

Bring in people who already have an account somewhere else.

<Cards>
  <Card href="/connections/sign-in-with" title="Add sign-in with another identity provider">
    Google, Microsoft, Okta, GitHub, GitLab, or any OpenID Connect or SAML provider.
  </Card>
  <Card href="/connections/scim" title="Provision people with SCIM">
    Keep accounts in step with your directory, in and out.
  </Card>
</Cards>

### AI agents

Give each agent its own identity, limit what it may do, and put a person in the loop.

<Cards>
  <Card href="/agents/how-it-works" title="How agent sign-in works">
    The model, from registration to an approved action, and the standard behind each step.
  </Card>
  <Card href="/agents/limits" title="Limit what an agent may do">
    Capabilities, limits on their arguments, and rules that ask a person.
  </Card>
  <Card href="/agents/approvals" title="Ask before a sensitive action">
    Bind a token to one action and wait for a person when a rule requires one.
  </Card>
  <Card href="/agents/ciba" title="Ask a named person to approve">
    Have one person approve on their own device, and receive a token that names them.
  </Card>
  <Card href="/agents/mcp-gateway" title="The MCP gateway">
    A grant per tool, and credentials the agent never sees.
  </Card>
  <Card href="/agents/verify" title="Accept agents at your own API">
    Validate an agent's access token in your service.
  </Card>
  <Card href="/agents/revocation" title="Revoke an agent">
    Revoke an agent, and have your services told when it happens.
  </Card>
</Cards>

### Zero-Code

Sign-in and access rules for services on Kubernetes, decided on the node.

<Cards>
  <Card href="/zero-code/overview" title="How Zero-Code works">
    The three steps every workload goes through: Observe, Classify and Protect.
  </Card>
  <Card href="/zero-code/install" title="Install Zero-Code on a cluster">
    Connect a cluster with one Helm command.
  </Card>
  <Card href="/zero-code/protect-ui" title="Protect a web app">
    Put your project's sign-in in front of a service people open in a browser.
  </Card>
  <Card href="/zero-code/protect-api" title="Protect an API">
    Require an access token issued for that API, with rules for each route.
  </Card>
  <Card href="/zero-code/enforcement" title="How enforcement works">
    What is decided on the node, and the boundary around an AI agent.
  </Card>
  <Card href="/zero-code/compliance" title="Check compliance and apply the rules that close it">
    Score a cluster against published frameworks and apply the fix with built-in admission or Kyverno.
  </Card>
</Cards>

### Access

Reach servers and cloud accounts with credentials that last minutes.

<Cards>
  <Card href="/access/servers" title="Set up server access with SSH certificates">
    SSH certificates that last five minutes.
  </Card>
  <Card href="/access/cloud" title="Grant cloud roles without stored keys">
    Assume an AWS role with your AuthFI identity.
  </Card>
</Cards>

### Security

The keys your project signs with, and the record of everything that happened.

<Cards>
  <Card href="/security/keys" title="Keys and secrets">
    The keys a project has, what happens when one rotates, and how secrets are kept.
  </Card>
  <Card href="/security/audit" title="Use the audit record">
    Search it, send it to your log tools, and see that it was not altered.
  </Card>
</Cards>

### Extend

Connect your own code to what happens in your project.

<Cards>
  <Card href="/extend/webhooks" title="Receive webhooks">
    Have your project call your server when something happens.
  </Card>
  <Card href="/extend/actions" title="Run actions at sign-in">
    Run your own rules while a person signs in, and add claims to their tokens.
  </Card>
</Cards>

### Reference

Every endpoint, token and error, for looking things up.

<Cards>
  <Card href="/reference/oauth" title="OAuth and OpenID Connect endpoints">
    Each parameter and response of each endpoint an application calls.
  </Card>
  <Card href="/reference/discovery" title="Discovery documents">
    The documents a project publishes about itself.
  </Card>
  <Card href="/reference/tokens" title="Tokens and claims">
    What each kind of token is for, how long it lasts and what it carries.
  </Card>
  <Card href="/reference/errors" title="Errors">
    How errors are shaped, and what each code means.
  </Card>
</Cards>

## How these pages are written

- **Every URL is real.** Examples use a project called `acme`. Replace `acme.authfi.io` with your own project's issuer and they run.
- **Standards are named.** Where AuthFI implements a published standard, the page says which one, so any library for that standard works.
- **Every page is checked against the product.** What a page describes is what your project does.

## For AI assistants

Every page is also available as plain Markdown: add `.md` to its URL. The list of all pages is at [llms.txt](/llms.txt).