Identity
IdentityAmbiguous Identity. Auth, workspace management, and access control for humans and AI coworkers. One user schema, one system, one front door.
One account system where humans and AI coworkers share the same roster, the same permissions, and the same audit trail. Sign in with a magic link. Provision an AI coworker with one command. Manage billing, review activity logs, and control access from a single surface.
Workspace management
Sign in with Google or email and password. Manage your profile, workspace memberships, and notification preferences. Invite teammates by email.
Member provisioning
Add humans by email invite, add coworkers via API or CLI. Same roster, same permission model: viewer, editor, or admin.
Included from day one
The rest of the Identity feature set. Every item ships in every workspace, for your team and your AI coworkers alike.
Billing & actions dashboard
See free-tier usage (1,000 actions/month), top-up history, per-coworker action breakdown. One surface for cost visibility.
Compare plans→Audit log
Every action by every user, human or coworker, in a searchable, filterable timeline. Who did what, when, to which resource.
Workspace settings
Domain, display name, default permissions, data-retention policy. One control surface for the workspace owner.
One product, two ways in
Your agent authenticates with a single API key minted via the CLI. The key carries the same workspace-scoped JWT claims as a human session: same permissions, same audit trail, same API surface.
// Check current identity via MCP
const result = await mcp.callTool("identity.whoami", {});
// Returns: { id, email, display_name, role, workspace_id }What your agent can do in Identity
Every action your team takes in Identity, your agent can do the same way.
| Method | Description |
|---|---|
| admin.listUsers | List all workspace members (humans and agents) |
| admin.provisionAgent | Create a new agent user with its own API key |
| admin.updateUser | Update a user's role, name, or permissions |
| admin.suspendUser | Suspend a user and revoke their access |
| admin.inviteUser | Invite a human to the workspace via email |
| admin.createApiKey | Create a scoped API key for an agent or service |
| admin.rotateApiKey | Rotate an API key (invalidates the previous one) |
One user table for humans and coworkers
Same JWT format, same permission model, same workspace scoping. Identity parity is structural, not bolted on.
Get started
The Full Workspace
How humans and coworkers authenticate
Three entry points into the same identity system. Same JWT format, same workspace scoping.
Human auth
Magic-link email (passwordless by default). No password required; password optional for users who prefer it. JWT session scoped to the workspace.
Agent auth
API key (ak_...) minted at provisioning time. One key per agent. Revocable from the workspace management surface.
Claim-token (self-bootstrap)
Agent provisions itself via POST /api/auth/signup-agent. Workspace enters provisional state. Human claims via email magic link. Safe delegation.
Security posture
TLS 1.3, encrypted at rest, workspace-scoped tenant isolation, audit log on every action.
No SAML/SSO/DLP claims; those ship when they ship. What's live today: TLS everywhere, AES-256 at rest, workspace-scoped DB isolation, and a searchable audit log for every action by every user. Read the full security posture →
The Identity surface is the login screen
Humans and agents enter through the same system. Different entry points, same architecture.