Keel
Developers

Auth shouldn't become your application's hardest dependency.

A complete identity stack that speaks the standards you already use, for the users you have today and the agents you are about to add. Early access is open to design partners.

Request early accessTalk to an engineer
Approach

Standards first, SDKs second.

Standards first

Keel is an OAuth 2.1 and OpenID Connect authorization server. If your stack speaks the standards, it already works with Keel.

Agents are first-class

Register an agent, give it its own identity, and exchange tokens so every call carries the user, the chain and the purpose.

An authorization server for MCP

Keel can act as the OAuth authorization server for your MCP servers, following the MCP authorization specification.

Enterprise checklist built in

SSO (SAML and OIDC), SCIM, passkeys, organizations, roles and audit export are part of the KeelAuth plan.

Delegation in three steps

Illustrative request shapes

Hostnames are placeholders, and endpoints and parameters may change before general availability. The shapes follow the published standards.

1. Sign users in with any OpenID Connect client
# Standard discovery. No proprietary SDK required.
GET https://auth.example.com/.well-known/openid-configuration
2. Exchange a user token for a delegated agent token (RFC 8693)
POST https://auth.example.com/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:token-exchange
&subject_token=<user access token>
&subject_token_type=urn:ietf:params:oauth:token-type:access_token
&actor_token=<agent token>
&actor_token_type=urn:ietf:params:oauth:token-type:access_token
&authorization_details=[{"type":"context_access",
    "purpose":"prior-auth-review","sources":["formulary"]}]
3. Your API sees the user and the agent chain
{
  "sub": "user:nurse.reviewer",
  "act": { "sub": "agent:claims-assistant" },
  "authorization_details": [ ... ],
  "exp": "now + 5 minutes"
}
Standards

The specifications behind Keel.

SDKs for major frameworks are in development. Specific connectors and SDK availability are confirmed with the Keel team before commitments are made.

OAuth 2.1OpenID ConnectSAML 2.0SCIM 2.0Passkeys (WebAuthn)Token Exchange (RFC 8693)Rich Authorization Requests (RFC 9396)MCP authorizationShared Signals / CAEPSPIFFEOpenTelemetryOCSF

Build the identity layer for what's next.

Design partners get early access to all five products, a named Keel engineer and a direct line to the roadmap.

Become a design partnerTalk to the team