--- title: "Identity: Auth for Humans and AI | Ambiguous" description: "One account system for humans and AI coworkers. Magic-link auth, API keys, workspace management, and audit log. Create a workspace free." canonical: "https://www.ambiguous.ai/applications/identity" --- MCP-ready # Identity **Ambiguous Identity**. Auth, workspace management, and access control for humans and AI coworkers. One user schema, one system, one front door. Create a workspace[Provision an agent](https://www.ambiguous.ai/applications/identity#agent) Free foreverNo credit card One account system where humans and AI coworkers share the same roster, the same permissions, and the same audit trail. Sign in with a magic link. Provision an AI coworker with one command. Manage billing, review activity logs, and control access from a single surface. ## Workspace management Sign in with Google or email and password. Manage your profile, workspace memberships, and notification preferences. Invite teammates by email. Workspace homeYour landing page after sign-in. Quick access to all apps, recent activity, and team members.Account registrationSign up with your name and email, or continue with Google. Your workspace URL and email are ready before you finish.Workspace switcherSwitch between workspaces instantly. Each workspace is isolated with its own team and data. ### Member provisioning Add humans by email invite, add coworkers via API or CLI. Same roster, same permission model: viewer, editor, or admin. 10k Admin Ask assistant12RRyan Home Team Members People & accessWorkspaceBillingIntegrationsActivity Users Groups Guests Invites Roles API keys Search users… All typesAll roles 5 usersNew agent\+ Invite NameEmailTypeRole RW Ryan Waliany ryan@kova.ambiguous.aihumanadmin SC Sarah Chen sarah@kova.ambiguous.aihumanmember JW James Wilson james@kova.ambiguous.aihumanmember A Aria aria@kova.ambiguous.aiagentmember RB Research Bot research-bot@kova.ambiguous.aiagentmember Ryan ### Included from day one The rest of the Identity feature set. Every item ships in every workspace, for your team and your AI coworkers alike. Everything included * Billing & actions dashboard See free-tier usage (1,000 actions/month), top-up history, per-coworker action breakdown. One surface for cost visibility. [Compare plans→](https://www.ambiguous.ai/pricing) * Audit log Every action by every user, human or coworker, in a searchable, filterable timeline. Who did what, when, to which resource. * Workspace settings Domain, display name, default permissions, data-retention policy. One control surface for the workspace owner. ## One product, two ways in Your agent authenticates with a single API key minted via the CLI. The key carries the same workspace-scoped JWT claims as a human session: same permissions, same audit trail, same API surface. Your team's view 10k Admin Ask assistant12RRyan Home Workspace Members People & accessWorkspaceBillingIntegrationsActivity Users Groups Guests Invites Roles API keys Search users… All typesAll roles 5 usersNew agent\+ Invite NameEmailTypeRole RW Ryan Waliany ryan@kova.ambiguous.aihumanadmin ET Emily Torres emily@kova.ambiguous.aihumanmember MJ Marcus Johnson marcus@kova.ambiguous.aihumanmember A Aria aria@kova.ambiguous.aiagentmember RB Research Bot research-bot@kova.ambiguous.aiagentmember Your agent's view mcp-identity-whoami.ts Copy ``` // Check current identity via MCP const result = await mcp.callTool("identity.whoami", {}); // Returns: { id, email, display_name, role, workspace_id } ``` ## What your agent can do in Identity Every action your team takes in Identity, your agent can do the same way. | Method | Description | | --- | --- | | list_users | List all workspace members (humans and agents) | | provision_agent | Create a new agent user with its own API key | | update_user | Update a user's role, name, or permissions | | admin_user_suspend | Suspend a user and revoke their access | | invite_user | Invite a human to the workspace via email | | create_api_key | Create a scoped API key for an agent or service | | rotate_api_key | Rotate an API key (invalidates the previous one) | [See tools for all apps →](https://www.ambiguous.ai/assistant#tool-catalog) ## One user table for humans and coworkers Same JWT format, same permission model, same workspace scoping. Identity parity is structural, not bolted on. ## Get started For your teamFor your agents Get started with a free workspace. All 18 apps included, no credit card required. [Create a workspace](https://app.ambiguous.ai/register) ## The Full Workspace [Ambiguous Automations Trigger, filter, and action workflows connecting webhooks, events, and the Assistant. ](https://www.ambiguous.ai/applications/automations) [Ambiguous Docs Collaborative document editing for humans and AI coworkers. ](https://www.ambiguous.ai/applications/docs) [Ambiguous Sheets Organize and analyze tabular data. Your team writes formulas; your coworkers read ranges and patch cells. ](https://www.ambiguous.ai/applications/sheets) [Ambiguous Docs Collaborative document editing for humans and AI coworkers. ](https://www.ambiguous.ai/applications/docs) [View all applications →](https://www.ambiguous.ai/applications) ## How humans and coworkers authenticate Three entry points into the same identity system. Same JWT format, same workspace scoping. ### Human auth Magic-link email (passwordless by default). No password required; password optional for users who prefer it. JWT session scoped to the workspace. ### Agent auth API key (`ak_...`) minted at provisioning time. One key per agent. Revocable from the workspace management surface. ### Claim-token (self-bootstrap) Agent provisions itself via `POST /api/auth/signup-agent`. Workspace enters provisional state. Human claims via email magic link. Safe delegation. ## Security posture TLS 1.3, encrypted at rest, workspace-scoped tenant isolation, audit log on every action. No SAML/SSO/DLP claims; those ship when they ship. What's live today: TLS everywhere, AES-256 at rest, workspace-scoped DB isolation, and a searchable audit log for every action by every user. [Read the full security posture →](https://www.ambiguous.ai/security) ## The Identity surface is the login screen Humans and agents enter through the same system. Different entry points, same architecture. ### Sign in as a human Sign in with Google or email and password. Open login → ### Provision an agent Your agent gets its own inbox, API key, and access to every app. Copy one command to start. Open provisioning →