LumoAuth handles sign-in and access control for your product. It covers your human users and the AI agents that act for them, in one platform with a single audit log.
Passwordless sign-in for your users. The hosted sign-in page offers passkeys (Face ID, Touch ID, Windows Hello, security keys), magic links, one-time codes, and push approval through the Lumo Authenticator app for iPhone and Android. It also supports social logins and customer SSO through Okta, Entra ID and others. A second factor is asked for only when something looks unusual, such as a new device, a new country or impossible travel. You switch methods on in the portal, so your application code doesn’t change. The page runs on your own domain with your branding.
Identity and guardrails for AI agents. Each agent is registered with a name, an owner, its own credentials and a fixed list of what it may do. When an agent needs a permission it doesn’t have, it sends a request with a reason. A person approves or denies it from the portal, the Lumo Authenticator app, Slack, Teams, ServiceNow or Jira. An approved request returns a token that works for that one task and expires within minutes. Budgets cap an agent’s steps, time and spend, and a kill switch cuts off its access at once. Every action goes to the audit log, with trace IDs you can open in Langfuse or LangSmith.
MCP server authorization. Register your MCP servers so agents can find them through standard discovery. Agents get one token per tool, and you can revoke any token.
Enterprise and B2B features. Organizations, customer SSO, a SAML identity provider, SCIM and HR directory sync, and a portal where your customers’ admins manage their own users. Access control combines roles, attribute rules and relationships behind one check endpoint, and you can write policies in plain English.
Security and compliance. Breached-password checks, CAPTCHA, risk scoring, threat detection and lockout. Consent management, data-subject requests, processing records, a breach clock, and audit logs you can stream to your SIEM.
Built for developers. SDKs for JavaScript/TypeScript, Python, Go, PHP, Java and .NET, plus packages for Next.js, React, FastAPI, Spring Boot, Laravel and other frameworks. You also get an Admin API, a CLI with sandboxes and webhook tunnels, Terraform and Kubernetes support, and more than 180 integrations. LumoAuth works with any OpenID Connect library.
Open standards, no lock-in. OpenID Connect, OAuth 2.1, FIDO2 passkeys, SAML 2.0, SCIM 2.0, FAPI 2.0, DPoP, CAEP and AuthZEN.
Pricing. The free plan covers 10,000 monthly active users and 10 agents, with no credit card. Passkeys, MFA, attack protection and agent identity are included on every plan.
