AuthSecAuthSec
Apache V2 License →

Agent-first
Open Source
Identity layer for
Autonomous AI.

The open-source authentication and authorization platform for AI agents, MCP servers, and autonomous workloads — with real-time policy enforcement and full auditability.

Explore docsAccess open source
What we do
01

Agentic Identity & Authentication

Agent-native authentication and authorization for AI agents.

Jump to section →
02

Agentic IGA

Identity governance for agents on Kubernetes, EC2, Azure, GCP, and non-cloud deployed processes.

Jump to section →
01 · Agentic Identity & Authentication

AuthSec Agentic Identity & Authentication

How AI agents get their own identity, sign in, and receive only the access they are authorized for — including when they act on behalf of users.

Get started with the following command
$ git clone https://github.com/authsec-ai/authsec.git
View all capabilities

Agentic authentication

Every agent and MCP server gets its own verifiable identity and signs in with OAuth 2.1 + PKCE — distinct from, and traceable to, the user it works for.

  • AI agent identity
  • MCP server auth
  • OAuth 2.1 + PKCE
  • M2M tokens
  • OIDC federation
  • Passkeys & MFA

Agentic authorization

Scoped, expiring permissions decide what an agent may call — including when it acts on behalf of a user. Policies are enforced live and every decision is logged.

  • Trust delegation
  • Cross-app agent auth
  • Policy engine
  • Connector broker
  • Audit & governance
Quick start SDK

Integrate AuthSec in minutes

Official SDKs for Python, Go, and TypeScript — plus native integrations for LangChain, CrewAI, AutoGen, and secret management.

Language SDKs · AI framework integrations
View all SDKs
~/my-agent — Python
# Install the Python SDK
pip install authsec-sdk
from authsec_sdk import protected_by_AuthSec
@protected_by_AuthSec("database.read")
async def query_db(args: dict) -> list:
return await db.execute(args["query"])
✓ Agent authenticated → tool access granted
Python · MCP servers, AI agents & OAuth 2.1Docs →
Book a live demo · 30 min

See AuthSec secure your agents, on your stack.

A working session with an AuthSec engineer — not a sales pitch. Tell us what your agents do and where they run; we show you exactly how to authenticate, authorize and sandbox them.

  1. 01
    We map your setup
    Agents, MCP servers, users and environments.
  2. 02
    Live demo on your use case
    Agent identity, policy and sandboxing, end to end.
  3. 03
    You leave with a rollout plan
    Which SDKs, which policies, what to ship first.
Schedule your demo
Takes 30 seconds. You pick the time on the next step.
What do you want to secure?
Where do your agents run?
An engineer joins the call. No spam.Rather self-serve? Start on GitHub →
02Agentic IGA

Sandbox and protect your agents in 5 mins

Governance for agents and processes, wherever they run.

linux host
# 1. Sandbox and protect your agents
$ sudo TENANT_ID="<your-tenant-id>" bash install.sh
[1/5] Creating spire-agent system user... [5/5] Installing systemd service... === Installation Complete ===
✓ Agent attested — spiffe://<tenant-id>/agent/<hostname>
≈ 5 min · EC2, Azure VM, GCP instance, on-prem — same installer
[Demo video — TBD]16:9
Supported environments
Kubernetes
k8s
AWS EC2
ec2
Azure
azure
GCP
gcp
Non-cloud processes
on-prem / self-hosted
① Attestation — SPIRE agents prove node & workload identity to the server
Zero-trust runtime

Support non-human identity authorization with SPIFFE.

Agents and MCP servers get cryptographic X.509 identities, exchanged for short-lived, call-specific JWTs to shrink blast radius.

  • Workload identity (SVID) — a unique X.509 SPIFFE SVID per agent at startup.
  • Certificate-based auth — short-lived X.509 certificates, no long-lived secrets.
  • mTLS with auto-rotation — certificates rotated automatically before expiry.
  • Root CA & Vault-backed PKI — issuance from a trusted root via HashiCorp Vault.
Core Modules

Dual plane for AI agent and user identity

Secure users and autonomous workloads with the same policy engine, observability, and controls. No more parallel auth stacks.

OAuth2.1 for User Authentication

Native OAuth2.1 support with Authorization Code + PKCE. Issue short-lived, user-bound tokens without building custom auth flows.

User-first security · PKCE by default · Risk-based MFA
Learn more
Client Appclient_id:app_123flow:PKCEchallenge:S256(xyz)AuthSecOAuth 2.1 EnginePKCE VerifierScope CheckConsent LogicAccess Tokensub: user_123scope: openid profile
Go live faster

Ready to secure your users and MCP servers?

Enterprise-grade security with OAuth 2.1, AI agent authentication, and zero-trust — open source and self-hostable.

OAuth 2.1 & PKCE
MCP server authentication
AI agent workload identity
Zero-trust security posture

Get secure in minutes

No infrastructure setup required.

No spam. Security updates only.

Insights

Featured Posts

Learn about authentication patterns, security best practices, and AI agent identity from our engineering team.

View all posts