01
Sign-in gets rebuilt in every app
Each product grows its own login form, reset flow and social buttons, and they drift apart.
NewAI agents that never see your secrets
Sign-in, access and billing for every app you ship
One console for how people sign in, what they and their AI agents may do, and what they pay for. Your apps read it through one SDK, so a change you make reaches every app without a redeploy.
- OAuth 2.1
- OpenID Connect
- SAML
- SCIM
- WebAuthn passkeys
- MCP
Ms
TinAI agents & MCP
Secure API and agent exchange for autonomous work
AI agents and services act for people and apps with access that is scoped, consented, revocable and audited. They use your API keys, logins and signing keys without ever seeing them.
- Scoped, consented, time-limited grants per agent and per item
- Revocable in one click, one agent or all of them
- Every grant, use and refusal in a hash-chained audit trail
- Autonomous browser sign-in: the agent's Chrome signs in to a site, and the model never sees the password
- 01
Your agent asks for one item
A grant names the item, the operations, the hosts and how long.
- 02
You approve it once
In your vault, after a fresh step-up. Nothing to approve again until it ends.
- 03
Its token works at one place only
Bound to that resource; every other API refuses it.
- 04
Sensitive use waits for your tap
Match the number on Vaarta Authenticator, for items that ask every time.
- 05
The agent gets the result
An API response, a signed-in browser or a signature. Never the secret.
Why Identity Studio
Fewer breaches, faster shipping, agents that can actually work
Six things you get here that are hard to assemble anywhere else. Each one is in the code today.
Agents act, secrets stay sealed
Hand autonomous work to an agent without handing it your keys.
Use-without-reveal over MCP and the local credential bridge
Every sensitive action, approved by matching a number
Push fatigue stops working: only someone looking at the real request knows which number to tap.
Vaarta Authenticator, signed answers, single-use approvals
Tokens bound to one resource
A token taken from one place is useless anywhere else, and a stolen refresh token kills its own chain.
RFC 8707 audience binding · refresh rotation with reuse detection
Our own bot check, no third-party tracking
Keep bots out of sign-in without a puzzle and without sending visitors to an ad network.
First-party proof-of-work CAPTCHA, bound to page, app and host
Identity, access, billing and secrets in one platform
Ship faster: one set of people, organizations and audit trail behind every product.
Identity Studio and Vaarta Vault share sign-in, approvals and audit
Standards, not lock-in
Your customers' IdPs, directories and SIEMs already speak these, so leaving is as easy as joining.
OAuth 2.1, OpenID Connect, SAML, SCIM, WebAuthn, MCP, CEF, OCSF
The problem
Every product ends up rebuilding the same front door
02
Access lives in if-statements
Roles, plan limits and customer boundaries get hard-coded, so a pricing change becomes a release.
03
Agents need keys you cannot give them
Pasting an API key into an agent's context means it can leak, be replayed or outlive the task.
How it works
Configure it once. Every app follows.
1Console
Register your app
Development, staging and production, each with its own credentials and signing keys.
2Console
Design sign-in, roles and plans
Order the sign-in steps, declare permissions, price your plans, connect agents.
3Your app
Read it through the SDK
The web package renders the sign-in; the backend verifies tokens offline; the edge package keeps devices on plan.
login.ts
import { fetchLoginSurface, FALLBACK_LOGIN_SURFACE } from '@vaarta/auth-flow'; // The steps you set in the console, in your order.const surface = (await fetchLoginSurface(authConfig)) ?? FALLBACK_LOGIN_SURFACE;Turn on passkeys, reorder steps or switch off passwords, and every app reading Identity Studio changes with you.
Console · sign-in stepsdrag to reorder
- Passkey
- Password
- Magic link
Your web app
Sign in
Password
Magic link
Your customer portal
Sign in
Password
Magic link
Your admin console
Sign in
Password
Magic link
Illustration · try a switch: every app updates, no redeploy
The platform
Fifteen products that share one set of people, organizations and records
Take the whole platform or start with one piece. Nothing has to be stitched together later.
Agents & APIs
4Sign-in
5Access & revenue
6- OrganizationsCustomers, workspaces, teams, domains
- SCIM provisioningDirectories add and remove people
- Roles & permissionsRoles, policies, separation of duties
- Audit & SIEM exportA hash-chained trail, CEF and OCSF
- Billing & plansSell plans with trials and invoices
- Edge & entitlementsPlan limits on devices, even offline
Integrations
Connect the services your customers already use
Identity providers, directories, payment gateways, messaging, bot checks and AI agents, plus a catalogue of 91 more connectors in early access.
Built on Identity Studio
We run our own products on it
Every Vaarta product signs people in, checks access and records what happened through Identity Studio.
Vaarta Converse, Automation Studio, Analytics and Data Studio verify Identity Studio tokens in their backends with the same vaarta_iam package we ship to you.
Security and standards
Built on the standards your customers' security teams ask for
Plans
A plan for every stage
Every plan includes the whole platform. They differ in how much you run on it.
Plan 1
One product team getting serious about identity.
Plan 2
A B2B product in production, with customer organizations and an edge fleet.
Plan 3
Large deployments. No limit ever blocks you.
Give every app a sign-in people trust, and agents you can
Book a demo and we will walk through your sign-in, your plans and your first connected agent.