DocsOverview
Documentation
Authentication and authorization for AI agents and MCP servers. Guides for agent identity, access control, and observability. Have your agent follow the skill, or use the sidebar when you need a specific page.
Start here
Ship sign-in in five minutes
Pick your framework, create an environment, and run the callback. One path, from an empty project to a signed-in user.
Products
Agentic Identity, Access Control, Observability, and Console.
Agentic Identity
Give each workload its own credential, and put MCP in front of the tools it can call.
Access Control
Pick one access model per environment, and use the same check from your app.
Observability
Search, correlate, and triage identity Signals in one place.
Console
See how the workspace is laid out, and how you switch from one context to another.
Concepts
How Authdog models identity, access, and tenancy.
Authentication
How sign-in works, and the session your app gets back.
Authorization
What a signed-in user is allowed to do, checked on the server.
Sessions & tokens
The session token your app checks on every request.
Multi-tenancy
How tenants, projects, and environments stay separate.
Organizations
Billing and admin above your tenants.
Provisioning
Let a customer's directory create and remove users for you.
Application starters
A runnable app for each framework. Open one for the integration that stack ships. Clone the same folder from authdog/samples.
Frontend
Team dashboardNext.jsProject status for the signed-in member. Billing, Mobile, and Docs render only after userinfo accepts the session.
Customer navbarReact ElementsShop catalog under a navbar that opens hosted sign-in. Orders stay on a server app that holds the session.
Support inboxRemixCustomer tickets on /inbox. The loader redirects anonymous agents before the list renders.Field companionReact Native / ExpoToday's site visits after a deep-link return. The job list renders only after userinfo accepts the token in secure storage.
Member siteSvelteKitPublic home, member library on /library. getUser redirects anonymous readers before the guides load.
Ops consoleTanStack StartOpen incidents for the on-call operator. Anonymous visitors see the sign-in link and no incident rows.
Workspace settingsVueWorkspace name, timezone, and join notification after hosted sign-in. The fields stay hidden until userinfo returns a user.
Admin consoleAngularTeam directory on /directory. The route guard keeps the list off screen until fetchUser returns a user.
HandbookAstroPublic chapters on the home page. Member chapters on /handbook load only after getUser accepts the session.
Resource libraryGatsbyTitles on the public page. GET /api/files returns the board pack and runbook only after requireAuth.
Job boardRedwoodJSListings stay public. The applications function returns candidates only after requireAuth.Backend
Orders APIExpressGET /orders returns open orders for the signed-in clerk and 401 for everyone else.
Inventory APIFastifyGET /skus returns on-hand stock for the signed-in clerk and 401 for everyone else.
Booking APIFastAPIGET /bookings returns room reservations. Routes without a session return 401.
Clinic portalDjangoGET /appointments returns today's clinic slots. Anonymous callers are rejected.
Status boardFlaskGET / publishes component state. GET /notes returns the internal timeline only with a session.
Intake serviceStarletteGET /intakes returns the waiting queue. Anonymous callers are rejected.
Event ingestaiohttpGET /events returns recent door and check-in events. Handlers without a session are rejected.
Billing serviceGoGET /invoices returns open and paid invoices. Gin returns 401 unless Authdog authenticates the caller.
Policy serviceRustGET /policies returns shipping and refund rules. The Axum gate returns 401 without a session.Connectors
Every identity provider a user can sign in with. Enable each one per environment.
