Use cases
Identity for API and developer platforms
What a platform with a public API needs: user sign-in, customer-owned machine clients, scoped and short-lived tokens, and credential rotation.
The short answer
A developer platform has two audiences — the people who sign in to its dashboard and the programs that call its API. The people need ordinary multi-tenant sign-in. The programs need their own credentials, owned by the customer's tenant, exchanged for short-lived scoped tokens via the client credentials grant, and rotatable without downtime. Long-lived static API keys are the pattern to move away from.
Sources last reviewed .
What to provide
- Machine clients created and revoked by tenant administrators.
- Client credentials grant, with key-based client authentication for sensitive customers.
- Scopes and audiences per API, and short token lifetimes.
- Two concurrently valid secrets during rotation.
- Sender-constrained tokens (DPoP) where tokens cross untrusted networks.
- An audit trail that distinguishes human actions from machine actions.
In Authreads
How this applies to Authreads
Machine and agent identity — client credentials, DPoP and RFC 8693 token exchange — is Available, alongside hosted login for the dashboard users.
Authreads is a multi-tenant identity platform in beta. Capability status is maintained on /roadmap as Available, In progress or Planned.
Keep reading
Protocols and how-tos
Service-to-service authentication with the client credentials grant
Protocols and how-tos
DPoP implementation guide: sender-constrained tokens without mTLS
Use cases
Identity for AI agents: delegation, scoping and sender-constrained tokens
Glossary: Machine identity · Client credentials grant · DPoP
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.