Authentication and authorization for humans, services and AI agents.
KeelAuth is the identity layer of the Keel Platform: login and authorization for people, services and agents, with delegated access as a first-class concept.
Why KeelAuth
Most identity products treat an agent as an API client with a static key. KeelAuth gives every agent its own identity, binds it to the human or system it acts for, and carries that delegation through every hop, so agents can be governed and audited the way enterprises already govern people.
- Who it's for
- Developers and platform teams building B2B and B2C apps, and IAM teams that need agent identity next to workforce and customer identity.
- Build phase
- Phase 1 · Foundation. See the roadmap
What changes with Keel
| Problem | Today | With Keel |
|---|---|---|
| Agents share credentials | Agents use static API keys or one shared service account. | Each agent gets its own identity and short-lived tokens. |
| Delegation is invisible | Systems see the agent, not the user it acts for. | Tokens carry the user and the full agent chain. |
| Over-broad access | Agents inherit everything the key or user can reach. | Scopes narrowed per agent, task and purpose. |
| Separate stacks for humans and machines | Workforce IAM, customer identity and secrets tools each handle a slice. | One identity model for people, services and agents. |
| Hard enterprise readiness | Startups outgrow simple auth and must re-platform for SSO, SCIM and compliance. | Enterprise SSO, provisioning and audit designed in from day one. |
| Slow revocation | Long-lived tokens outlive the decision to cut access. | Short-lived tokens plus real-time revocation signals. |
Agents share credentials
Today · Agents use static API keys or one shared service account.
With Keel · Each agent gets its own identity and short-lived tokens.
Delegation is invisible
Today · Systems see the agent, not the user it acts for.
With Keel · Tokens carry the user and the full agent chain.
Over-broad access
Today · Agents inherit everything the key or user can reach.
With Keel · Scopes narrowed per agent, task and purpose.
Separate stacks for humans and machines
Today · Workforce IAM, customer identity and secrets tools each handle a slice.
With Keel · One identity model for people, services and agents.
Hard enterprise readiness
Today · Startups outgrow simple auth and must re-platform for SSO, SCIM and compliance.
With Keel · Enterprise SSO, provisioning and audit designed in from day one.
Slow revocation
Today · Long-lived tokens outlive the decision to cut access.
With Keel · Short-lived tokens plus real-time revocation signals.
What KeelAuth does
Core identity
- OAuth 2.1 and OpenID Connect authorization server
- Passwords, passkeys, magic links, social login, MFA
- Enterprise SSO (SAML, OIDC) and SCIM provisioning
- Organizations, roles and fine-grained permissions for B2B apps
- Hosted and embeddable login, SDKs for major frameworks
Agent and machine identity
- Agent identities with owner, classification and lifetime
- Delegated access by token exchange: user to agent, agent to agent, chain recorded
- Purpose and resource scoping carried in the token
- Machine-to-machine credentials and workload identity for services
- Authorization server for MCP servers
- Step-up consent: an agent asks for a higher scope and the user approves in real time
Security
- Short-lived tokens, refresh rotation, token binding where supported
- Real-time session and token revocation, with shared-signal events in and out
- Signing keys managed in KeelKey
How it works with the rest of Keel
Each Keel product feeds the others. The delegation chain and the audit trail only work when the same system issues the identity, makes the decision and records the result.
Built on standards you can evaluate
Nothing proprietary to adopt. These are the specifications the design is based on.
Put your first agent under control.
Join the design partner program: 90 days from federating your identity provider to a governed agent in production planning, with a named Keel engineer.