create_delegation plus check_permission is what separates this from a secret store: an orchestrator can grant a narrower scope to the agent it spawns, and that agent can ask whether an action is permitted before attempting it. Access tokens are short-lived, and the API key from quickstart is shown once.
An identity service for agents, reachable as an MCP server built into its API. It registers agents, issues and rotates credentials, exchanges them for short-lived access tokens, and records delegations between agents.
- quickstart — register a root agent and get its identity, API key, access token and refresh token in one call
- authenticate, refresh_token, introspect_token and revoke_token for the token lifecycle
- create_credential, rotate_credential and revoke_credential
- create_delegation and check_permission — one agent acting for another, and whether it is allowed to
- list_agents and get_agent
- discover — the supported grant types, available scopes, token lifetimes and endpoint URLs
For the hosted service, point a client at https://agentauth.radi.pro/mcp and nothing else is needed. For local or self-hosted use, the package agentauth-mcp-server runs over stdio and requires AGENTAUTH_URL; AGENTAUTH_API_KEY is optional and can be passed per call instead.
One command — npx -y mcp-remote https://agentauth.radi.pro/mcp