Getting started

AuthSec adds OAuth, per-tool RBAC, and audit logging to MCP servers, AI agents, and APIs. Three capabilities, each building on the last:

What you can do

Capability	What it does	Time	Guide
Protect an application	Every tool call requires a valid token with the right scopes. Admins control access from the dashboard, no code changes.	~15 min	Protect an application
M2M auth (3 methods)	Pipelines, CI jobs, and Kubernetes workloads call your server as themselves — client secret, private-key JWT, or SPIFFE.	~5 min each	Connect agents and services
ID-JAG delegation	AI agents act on behalf of a signed-in user — the user's permissions, the agent's identity, both revocable.	~20 min	ID-JAG agents

Each capability is self-contained. Most teams start with Protect, then add M2M or ID-JAG as callers come online.

Step	What	Time
1	Sign in and create a workspace	~2 min
2	Dashboard tour	~5 min
3	Protect your server — register, SDK, scopes, launch	~15 min
4	Connect callers — M2M (3 methods) or ID-JAG agents	5–20 min

If you want to...	Go to
Sign up and create a workspace	Sign in and create a workspace
See the dashboard for the first time	Dashboard overview
Protect one server, end to end (condensed)	From zero to launched
Protect one server (step-by-step, with screenshots)	Protect an application
Connect a pipeline or service (M2M)	Client secret · Private-key JWT · Kubernetes/SPIFFE
Wire an AI agent acting for users	ID-JAG agents
Install the SDK	Python · Go · TypeScript
Understand scopes, audiences, tokens	Concepts
Look up an API endpoint	Reference