# AuthFI Docs

> Documentation for AuthFI, the identity platform for people and AI agents.

- [AuthFI documentation](https://authfi.io/docs/index.md): Find the guide for what you are building. Sign people in, give AI agents their own identity and limits, and protect services you already run.
- [Grant cloud roles without stored keys](https://authfi.io/docs/access/cloud.md): Let people assume AWS roles with their AuthFI identity and receive credentials that expire after 15 minutes, with no access key created or stored.
- [Set up server access with SSH certificates](https://authfi.io/docs/access/servers.md): Let people reach Linux servers with SSH certificates that are valid for five minutes, signed by your project's own certificate authority.
- [Ask before a sensitive action](https://authfi.io/docs/agents/approvals.md): Bind a token to one action, ask AuthFI whether the agent may do it, and wait for a person to approve when a rule requires one.
- [Ask a named person to approve](https://authfi.io/docs/agents/ciba.md): Have an AI agent ask one named person to approve an action on their own device, and receive an access token that names both of them.
- [How agent sign-in works](https://authfi.io/docs/agents/how-it-works.md): How an AI agent gets an identity, a short-lived access token and permission for a single action, and which standard each step follows.
- [Limit what an agent may do](https://authfi.io/docs/agents/limits.md): Grant an AI agent a capability, set limits on the details of each action, and add project rules that deny an action or send it to a person.
- [The MCP gateway](https://authfi.io/docs/agents/mcp-gateway.md): Put your tool servers behind your project's MCP gateway, grant tools to AI agents one by one, and see what the gateway checks on every call.
- [Revoke an agent](https://authfi.io/docs/agents/revocation.md): Revoke an AI agent in one action, see what stops working and where, and have your own services told the moment it happens.
- [Accept agents at your own API](https://authfi.io/docs/agents/verify.md): Verify an AI agent's access token in your service, check that it was issued for your API, and confirm the one action it is bound to.
- [Get an access token for a backend service](https://authfi.io/docs/applications/machine-to-machine.md): Sign a backend service in as itself with the client credentials grant, and get an access token for the one API it calls.
- [Connect a SAML application](https://authfi.io/docs/applications/saml.md): Set up single sign-on to a SAML 2.0 application, with your AuthFI project as the identity provider.
- [Manage sessions, sign-out and MFA](https://authfi.io/docs/applications/sessions.md): Keep a person signed in with refresh tokens, sign them out, and require a fresh sign-in or multi-factor authentication (MFA).
- [Application types and redirect URIs](https://authfi.io/docs/applications/types.md): Choose between the four application types, and learn how AuthFI matches a redirect URI and decides who can sign in to an application.
- [Roles, groups and grants](https://authfi.io/docs/concepts/access.md): Understand the four things that decide what a person or agent may do, how a group passes access on, and the order in which a decision is made.
- [Projects and issuers](https://authfi.io/docs/concepts/projects.md): Understand what a project is, why its URL is the only value a client needs, and how a client finds the project's endpoints and signing keys from it.
- [Provision people with SCIM](https://authfi.io/docs/connections/scim.md): Create, suspend and restore people in your project from your identity provider over SCIM 2.0, and keep accounts in your applications current.
- [Add sign-in with another identity provider](https://authfi.io/docs/connections/sign-in-with.md): Let people sign in to your project with Google, Microsoft, Okta, GitHub, GitLab, or any OpenID Connect or SAML 2.0 identity provider.
- [Run actions at sign-in](https://authfi.io/docs/extend/actions.md): Run your own rules while a person signs in, to add claims to their token, deny the sign-in, or require multi-factor authentication.
- [Receive webhooks](https://authfi.io/docs/extend/webhooks.md): Have your project call your server when a person is created, a session ends or a sign-in fails, and verify that each call is genuine.
- [Glossary](https://authfi.io/docs/glossary.md): Look up the identity terms these docs use, each defined in a sentence or two with a link to the page that explains it.
- [Give an AI agent an identity](https://authfi.io/docs/quickstart/agent.md): Register an AI agent, sign it in with a key only the agent holds, and receive a 15-minute access token.
- [Connect an agent to tools](https://authfi.io/docs/quickstart/mcp.md): Connect a tool server to your project's MCP gateway, grant a tool to an agent, and call it with the agent's access token.
- [Add sign-in to an app](https://authfi.io/docs/quickstart/sign-in.md): Sign a person in to your application with OpenID Connect, using the authorization code flow with PKCE, and read who they are.
- [Discovery documents](https://authfi.io/docs/reference/discovery.md): Look up each document a project publishes about itself, with its URL, its standard, an example and what every field means.
- [Errors](https://authfi.io/docs/reference/errors.md): Look up the shape of an error response on each surface, what every error code means and what to do about it.
- [OAuth and OpenID Connect endpoints](https://authfi.io/docs/reference/oauth.md): Look up every endpoint an application calls to sign people in, with its parameters, responses, scopes and errors.
- [Tokens and claims](https://authfi.io/docs/reference/tokens.md): Look up each token a project issues, its lifetime, signing algorithm and claims, and how to validate one.
- [Use the audit record](https://authfi.io/docs/security/audit.md): Read and search your project's audit record, send its entries to your log tools, and check that no entry was changed or removed.
- [Keys and secrets](https://authfi.io/docs/security/keys.md): Learn which keys your project signs with, rotate or disable a key without breaking your services, and see how AuthFI stores secrets.
- [Check compliance and apply the rules that close it](https://authfi.io/docs/zero-code/compliance.md): Score a cluster against published frameworks, see which workloads fail each control, and apply the rule that closes it with Kubernetes built-in admission or with Kyverno.
- [How enforcement works](https://authfi.io/docs/zero-code/enforcement.md): Learn where Zero-Code makes each decision on a node, how an AI agent is held in a boundary, and how monitor mode, enforce mode and the brake fit.
- [Install Zero-Code on a cluster](https://authfi.io/docs/zero-code/install.md): Connect a Kubernetes cluster to your project with the command the console gives you, check that every node is covered, and upgrade or remove the install.
- [How Zero-Code works](https://authfi.io/docs/zero-code/overview.md): Learn how Zero-Code puts sign-in and access rules in front of services on Kubernetes without changing them, and the three steps every workload goes through.
- [Protect an API](https://authfi.io/docs/zero-code/protect-api.md): Require a valid access token issued for one API, write rules for who may call each route, and look up how route rules are matched.
- [Protect a web app](https://authfi.io/docs/zero-code/protect-ui.md): Put your project's sign-in in front of a service people open in a browser, choose who may open it, and read who is signed in from request headers.