Vaarta Identity Studio
Sign inBook a demo
Platform
NewAI agents that never see your secrets

Sign-in, access and billing for every app you ship

One console for how people sign in, what they and their AI agents may do, and what they pay for. Your apps read it through one SDK, so a change you make reaches every app without a redeploy.

Book a demoStart free trial

OAuth 2.1 · OpenID Connect · SAML · SCIM · WebAuthn passkeys · MCP

GoogleGitHubOktaStripe
OpenID ConnectWebAuthnModel Context ProtocolClaude Code
MsWhatsAppRazorpayCloudflare TurnstileBrevo
KeycloakHave I Been PwnedTin
AI agents & MCP

Secure API and agent exchange for autonomous work

AI agents and services act for people and apps with access that is scoped, consented, revocable and audited. They use your API keys, logins and signing keys without ever seeing them.

  • Scoped, consented, time-limited grants per agent and per item
  • Revocable in one click, one agent or all of them
  • Every grant, use and refusal in a hash-chained audit trail
  • Autonomous browser sign-in: the agent's Chrome signs in to a site, and the model never sees the password
  1. Your agent asks for one itemA grant names the item, the operations, the hosts and how long.
  2. You approve it onceIn your vault, after a fresh step-up. Nothing to approve again until it ends.
  3. Its token works at one place onlyBound to that resource; every other API refuses it.
  4. Sensitive use waits for your tapMatch the number on Vaarta Authenticator, for items that ask every time.
  5. The agent gets the resultAn API response, a signed-in browser or a signature. Never the secret.
Why Identity Studio

Fewer breaches, faster shipping, agents that can actually work

Six things you get here that are hard to assemble anywhere else. Each one is in the code today.

Agents act, secrets stay sealed

Hand autonomous work to an agent without handing it your keys.

Use-without-reveal over MCP and the local credential bridge

Every sensitive action, approved by matching a number

Push fatigue stops working: only someone looking at the real request knows which number to tap.

Vaarta Authenticator, signed answers, single-use approvals

Tokens bound to one resource

A token taken from one place is useless anywhere else, and a stolen refresh token kills its own chain.

RFC 8707 audience binding · refresh rotation with reuse detection

Our own bot check, no third-party tracking

Keep bots out of sign-in without a puzzle and without sending visitors to an ad network.

First-party proof-of-work CAPTCHA, bound to page, app and host

Identity, access, billing and secrets in one platform

Ship faster: one set of people, organizations and audit trail behind every product.

Identity Studio and Vaarta Vault share sign-in, approvals and audit

Standards, not lock-in

Your customers' IdPs, directories and SIEMs already speak these, so leaving is as easy as joining.

OAuth 2.1, OpenID Connect, SAML, SCIM, WebAuthn, MCP, CEF, OCSF

The problem

Every product ends up rebuilding the same front door

Sign-in gets rebuilt in every app

Each product grows its own login form, reset flow and social buttons, and they drift apart.

Access lives in if-statements

Roles, plan limits and customer boundaries get hard-coded, so a pricing change becomes a release.

Agents need keys you cannot give them

Pasting an API key into an agent's context means it can leak, be replayed or outlive the task.

How it works

Configure it once. Every app follows.

  1. 1ConsoleRegister your appDevelopment, staging and production, each with its own credentials and signing keys.
  2. 2ConsoleDesign sign-in, roles and plansOrder the sign-in steps, declare permissions, price your plans, connect agents.
  3. 3Your appRead it through the SDKThe web package renders the sign-in; the backend verifies tokens offline; the edge package keeps devices on plan.
login.ts
import { fetchLoginSurface, FALLBACK_LOGIN_SURFACE }
  from '@vaarta/auth-flow';

// The steps you set in the console, in your order.
const surface = (await fetchLoginSurface(authConfig))
  ?? FALLBACK_LOGIN_SURFACE;

Turn on passkeys, reorder steps or switch off passwords, and every app reading Identity Studio changes with you. Read about the SDKs →

The platform

Fifteen products that share one set of people, organizations and records

Take the whole platform or start with one piece. Nothing has to be stitched together later.

Agents & APIs
Sign-in
Access & revenue
Integrations

Connect the services your customers already use

Identity providers, directories, payment gateways, messaging, bot checks and AI agents, plus a catalogue of 91 more connectors in early access.

See all integrations →
Sign-in providersGoogleMsGitHubinGoogle, Microsoft, GitHub, LinkedInDirectoriesOktaMsOkta, Microsoft Entra IDPaymentsStripeRazorpayStripe, RazorpayMessagingWhatsAppTBrevoZWhatsApp, Twilio, Brevo, ZeptoMailBot checksCloudflare TurnstilehCrCCloudflare Turnstile, hCaptcha, Google reCAPTCHAAgents & keysClaude CodeKMSHave I Been PwnedClaude Code, AWS KMS, Have I Been Pwned
Built on Identity Studio

We run our own products on it

Every Vaarta product signs people in, checks access and records what happened through Identity Studio.

ObjiqObjiqCamera analytics across sites and fleets of edge devices. Our edge SDK's plan enforcement was built with Objiq as its first consumer.Edge SDKPlan limits on devicesdetection.objiq.ai ↗Vaarta VaultLogins, API keys, signing keys and cards in one encrypted vault. AI agents use them without ever seeing them.Push approvalsMCP for agentsAudit trailvault.vaarta.ai ↗Vaarta AuthenticatorApprove a sign-in or an agent's request by tapping the matching number. Linked by QR code; every answer is signed.Number matchingSigned answersTOTP codesHow it works →

Vaarta Converse, Automation Studio, Analytics and Data Studio verify Identity Studio tokens in their backends with the same vaarta_iam package we ship to you.

Security and standards

Built on the standards your customers' security teams ask for

OpenID ConnectOAuth 2.1 & OpenID ConnectCode + PKCE, rotation, discovery, JWKSEarly accessSAML 2.0Service provider and identity providerSCIM 2.0Users and groups from any directoryWebAuthnWebAuthn passkeysUser verification required by defaultModel Context ProtocolMCP authorizationRFC 9728 metadata, RFC 8707 bindingSigned webhooksHMAC-SHA256 with a timestampSIEM exportCEF and OCSF 1.5.0-aligned JSONHash-chained auditEdits and gaps show
Plans

A plan for every stage

Every plan includes the whole platform. They differ in how much you run on it.

See plans →
[PLAN 1]One product team getting serious. Two environments, five customer organizations.
[PLAN 2]A B2B product in production, with customer organizations and an edge fleet.
[PLAN 3]Large deployments. No limit ever blocks you.

Give every app a sign-in people trust, and agents you can

Book a demo and we will walk through your sign-in, your plans and your first connected agent.

Book a demoStart free trial