Keycloak

Drive the product through a documented public API G

Agent access

Connect an agent via an official MCP server G

Agent access

Delegate tasks to a built-in AI assistant inside the product G

Agentic features

Plug MCP servers into this product so it can use their tools G

Agent access

Issue scoped/least-privilege API credentials for an agent G

Agent access

Use an official CLI G

Agent access

Download a machine-readable API spec (OpenAPI or equivalent) G

Api quality

Run the product headlessly / in CI for automation G

Agent access

Build against official SDKs G

Agent access

Explore an interactive API reference with runnable examples G

Api quality

Point an agent at llms.txt or agent-oriented docs G

Agent access

Rely on versioned APIs with a documented deprecation policy G

Api quality

Get AI-generated insights and suggestions from my data inside the product G

Agentic features

Operate the product with natural-language commands G

Agentic features

Set up automations that run autonomously in the background G

Agentic features

Subscribe to events via webhooks G

Agent access

Test against a sandbox environment without touching production data G

Api quality

Implement standard OAuth 2.0 / OIDC flows (authorization code with PKCE, refresh tokens) without hand-rolling protocol details C

Flows

Issue machine-to-machine credentials (client-credentials flow) so backend services and agents authenticate without a human in the loop C

Machine identity

Self-host the core product G

Define roles and permissions and have them enforced and surfaced in session tokens for authorization checks G

Rbac

Connect enterprise identity providers over SAML and OIDC (Okta, Entra, Google Workspace) for workforce sign-in G

Sso

Manage session lifecycle — expiry, refresh, and immediate server-side revocation of a compromised session C

Sessions

Give each agent its own least-privilege machine identity with narrowly scoped permissions and instant revocation, instead of sharing a human's credentials C

Machine identity

Model multi-tenant B2B apps with organizations, memberships, and invitation flows out of the box C

Orgs

Put a spec-compliant OAuth authorization flow in front of my MCP server so remote agents connect with scoped, verifiable tokens C

Mcp

Export all of my data in open formats and leave G

Have an agent obtain short-lived, user-consented tokens for third-party APIs (token vault/exchange) so tool calls run under the user's delegated authority C

Delegation

Require multi-factor authentication with TOTP authenticator apps and backup codes, with step-up enforcement where needed G

Mfa

Define rules that trigger actions automatically on events G

Protect routes with first-party framework SDKs and middleware (Next.js and peers) that verify sessions at the edge C

Frameworks

Prevent my data from being used to train AI models G

Authenticate CLIs and headless agents via the OAuth device authorization flow instead of pasting long-lived secrets C

Device flow

Control where the auth system and its user data run — self-managed deployment, private instance, or my own database C

Deployment

Offer sign-in with a broad set of social and OAuth identity providers through configuration, not custom code G

Flows

Turn my own application into an OAuth provider that issues tokens to third-party clients ("Sign in with my app") C

Provider

Do everything through the API that I can do in the UI G

Ship production sign-in, sign-up, and profile management with prebuilt, customizable UI components or hosted pages C

Frameworks

Offer passkeys/WebAuthn and passwordless options like magic links or email OTP as first-class sign-in methods G

Passwordless

Sync users and groups from customer directories via SCIM so deprovisioning in the IdP revokes app access G

Sso

Bulk-import existing users — including password hashes — and export them again, so I am never locked in C

Migration

Perform bulk operations across many items at once G

Choose where my data is stored (region/residency) G

Give each customer organization its own SSO connection with verified domains and just-in-time provisioning G

Orgs

Control data retention and deletion G

Require asynchronous human approval (e.g. CIBA-style confirmation) before an autonomous agent completes a sensitive transaction C

Delegation

Capture tamper-evident audit logs of authentication and admin activity and stream or export them to my SIEM G

Audit

Opt out of telemetry and usage tracking G

Read the product's source under an open license G

Schedule recurring jobs or workflows G

Subscribe to webhooks or event streams for auth events (sign-ups, sign-ins, user changes) to keep my systems in sync C

Webhooks

Express fine-grained, resource-level authorization (relationship- or policy-based) beyond simple roles C

Rbac

Rely on built-in protection against bots, credential stuffing, and brute-force attacks on the auth flows C

Hardening

Let users and admins see active sessions and devices and revoke them individually or all at once C

Sessions

Follow vendor-maintained migration guides or tooling for moving off a competing auth provider without forcing password resets C

Migration

Version, review, and roll back my automations G