Identity that fits your stack.
INITE is an OAuth 2.0 / OIDC provider with passkeys, magic links, password fallback, Web3 wallet linking, and a service-token surface for backend-to-backend auth. Drop the SDK into your app, embed the iframe, or wire AI assistants in via MCP — no redirects required.
Passkeys
Phishing-resistant sign-in with Touch ID, Face ID, Windows Hello, or a hardware key.
OAuth 2.0 / OIDC
Standards-compliant authorization code + PKCE, refresh rotation, PAR, DPoP, back-channel logout.
Service tokens
client_credentials grant with audience binding and scoped JWTs — fleet-safe M2M auth.
Magic links
Passwordless email sign-in with rate limiting, replay protection, and HIBP-checked fallbacks.
Web3 wallets
Ethereum, Polygon, and TON linked via signed challenges — keep your crypto identity portable.
DID identity
Every user gets a did:key — portable across the INITE ecosystem and out of it.
AI agents, with limits
An agent signs in for a person with its own ID. Paying from the person’s INITE wallet takes their passkey and stays within the limits they set.
AI-ready (MCP)
Six auth-admin tools and three skills shipped via @inite/auth-admin — Claude Desktop, Cursor, Goose, n8n provision clients and respond to incidents through MCP.
Security defaults that don't need a security team.
Every primitive is on by default — you opt out of hardening, not into it. Audit log is queryable by both end users and operators.
- Account lockout with exponential backoff
- HIBP breached-password rejection
- Per-IP credential-stuffing defence
- Audit log surfaced to users and admins
- Embed-ready: CORS + CSP per partner
- Self-hostable, OSS license
Let an AI agent act for you, within limits you set.
Your assistant can sign in, buy and pay for you. Every service it visits sees who it is and whose agent it is, and you can switch it off from your account in one click.
How agents and the wallet work- Each connected app gets its own agent ID, tied to you
- You see what it asks for and approve on one screen
- Paying from your INITE wallet needs your passkey
- Limits per payment, per day and per month
- Your money stays yours: only your passkey can move it
- Disconnect it in your account and it stops at once
- An agent can also be on its own: its own ID and its own wallet
Embed in five lines.
Headless SDK + drop-in iframe widget. CORS and CSP auto-allow registered partner origins.
import { IniteAuth } from '@inite/auth-sdk'
const auth = new IniteAuth({ clientId: 'your-app-id' })
const { user, accessToken } = await auth.loginWithPassword({
email, password,
})AI assistants ship as a peer dependency.
Two lines in your vertical's bootstrap exposes provisioning, rotation, audit and revoke through every MCP client. Per-tenant role gates layer on top of OAuth scope.
import { registerAuthAdminTool, authAdminSkills } from '@inite/auth-admin'
import { registerSkill } from '@inite/skills'
registerAuthAdminTool()
for (const s of authAdminSkills) registerSkill(s)Questions people ask before adopting.
- What is INITE Identity?
- INITE Identity is a self-hostable OAuth 2.0 and OpenID Connect provider. It covers passkeys, magic links, password fallback, one-time codes, social sign-in and Web3 wallet linking, plus service tokens for backend-to-backend authentication, behind one SDK, an embeddable iframe, or an MCP surface for AI assistants.
- Which sign-in methods does INITE Identity support?
- Six: passkeys (WebAuthn via Touch ID, Face ID, Windows Hello or a hardware key), passwordless magic links by email, password with HIBP breached-credential rejection, one-time codes, social providers, and Web3 wallets on Ethereum, Polygon and TON linked through signed challenges. Every user also receives a portable did:key identifier.
- Can I self-host INITE Identity?
- Yes. The service is open core, licensed under AGPL-3.0-or-later, and ships with Docker Compose, Prisma migrations, metrics and backup guidance. A commercial license is available for proprietary distribution or hosted offerings that cannot meet the AGPL network-source obligation.
- Which OAuth 2.0 and OIDC features are implemented?
- Authorization code with PKCE, refresh-token rotation, the client_credentials grant with audience binding, the device grant, Pushed Authorization Requests (PAR), DPoP sender-constrained tokens, and back-channel logout. Discovery is served at /.well-known/openid-configuration with keys at /.well-known/jwks.json.
- How do AI assistants integrate with INITE Identity?
- Through the Model Context Protocol. The @inite/auth-admin package exposes six auth-administration tools and three guided skills that any MCP client — Claude Desktop, Cursor, Goose, n8n — can call to register and rotate OAuth clients, inspect audit trails and revoke sessions, acting as the signed-in administrator rather than a separate service identity.
- Can an AI agent pay on my behalf?
- Yes, from your INITE wallet: your own USDC on Base, which only your passkey can move. When an agent asks to pay, the consent screen shows its limits (by default $10 a payment, $20 a day, $50 a month) and you approve with a passkey. Each agent has its own ID, so services see whose agent is paying, and disconnecting it in your account stops it at once.
- How is INITE Identity secured by default?
- Hardening is opt-out, not opt-in: account lockout with exponential backoff, rejection of passwords found in known breaches, per-IP credential-stuffing defence, and an audit log queryable by both end users and operators. CORS and CSP auto-allow only registered partner origins.