--- source_url: "https://x-auth.com/?utm_source=openai" title: "X-Auth by XentraNET | Identity for Humans and AI Agents" mirrored_at: 2026-08-09T01:33:37.276Z host: x-auth.com cited_in_42a: true mirror_canonical: "https://index.42a.ai/x-auth.com/index__q__utm_source_openai" --- > **Original source:** https://x-auth.com/?utm_source=openai // XentraNET Identity Platform ## Identity for humans and the agents they deploy. X-Auth is the identity platform for the AI era. Risk-based authentication for your users. Scoped, pooled identities for your AI agents. One platform. Two products. **Zero shared service accounts.** Live risk signal RX-04 · 2026 Step-up threshold 04 /100 Low Device **recognized** Location **usual** Velocity **normal** The Threat 29% of U.S. adults experienced account takeover in 2024 80%+ of data breaches involve compromised credentials The Solution Zero instances of unauthorized access reported by X-Auth clients The ROI \>60% reduction in helpdesk costs for organizations on XentraNET The Platform ## One Platform. Two Products. X-Auth solves identity twice — once for the humans using your app, and once for the AI agents acting on their behalf. Shared risk engine. Shared console. Separate plans. X-Auth for Apps ### Risk-based OIDC, in five lines. Drop-in OIDC provider with a live risk score on every request. Your users glide through when trusted, get challenged when they shouldn't be. - Passkeys, WebAuthn, FIDO2, magic links - Continuous, signal-driven step-up - Policy engine with sensitivity-aware overrides - Integration as simple as social login [› see how it works](#apps) X-Auth for Agents ### Real identities for your AI agents. An MCP-native identity broker. Every MCP connection is bound to a scoped, revocable identity from a pool you control — no more shared service accounts or over-scoped keys. - Define personas (pre-authorized claim bundles) - Provision identity pools per workload - Install `mcp.x-auth.com`, pick a persona, OIDC does the rest - Audit every connection, revoke in one click [› see how it works](#agents) Product 01 · For Apps ## Authenticate your users without scaring them. Risk-based OIDC for the humans using your app. Seamless access for the trusted, hard stops for the rest. The Problem ## Don't Scare Your Customers Away Static authentication treats every login the same. That's not security — it's friction theater. > "Why are you asking for an SMS one-time code when I just want to log in and check my debit balance from the same home computer I use every single time?" That's your customer. Frustrated. Abandoning your app. Traditional authentication blasts every user with MFA hurdles regardless of how well you know them. Dynamic, risk-based authentication changes that. X-Auth evaluates a live trust score on every request — device reputation, behavioral patterns, location, and network signals — **continuously, not just at login**. As part of a Zero Trust framework, every access attempt is verified in real-time. Legitimate users glide through. Threats get stopped. Make accessing your system a low-friction experience for the good citizens of the internet, and a wall for everyone else. Risk-Based Authentication ## The Right Response for Every Risk Level X-Auth evaluates both the identity signals behind a request _and_ the sensitivity of what's being accessed — then matches the friction to the actual risk. LOW RISK ### Seamless Access e.g. login request for read-only access — trusted identity signals and low-sensitivity operation. - Trusted device fingerprint - Recognized IP & location - Consistent behavioral pattern - Low-sensitivity resource ✓ Instant access granted MEDIUM RISK ### Soft Step-Up e.g. report generation for sensitive data — elevated sensitivity or mild identity signal deviation. - Unrecognized browser or OS - Access outside normal hours - Sensitive resource requested - Moderate anomaly score → SMS OTP, magic email link, or FIDO2 HIGH RISK ### Strong Step-Up e.g. payment attempt — high-value operation, suspicious signals, or both. - High-value or irreversible action - Unknown device or flagged IP - Behavioral anomaly detected - Credential stuffing pattern ⛔ Push or FIDO2 with knowledge or possession factor Intelligence Engine ## Every Signal. Evaluated in Real-Time. X-Auth ingests four categories of signals continuously to build a live trust score for every session — not just at login. CH·DEV ### Device Reputation Each device is fingerprinted and scored against historical fraud patterns and browser entropy. New or anomalous devices are flagged before a credential is ever entered. device fingerprint fraud history browser entropy CH·BIO ### Behavioral Biometrics AI/ML models build a behavioral baseline for each user — typing cadence, mouse dynamics, touch pressure, and navigation patterns. Deviations trigger escalation automatically. typing cadence mouse dynamics touch pressure AI/ML CH·NET ### Network Risk IP reputation, geo-fencing, traffic velocity analysis, VPN detection, and Tor exit node identification guard against proxy abuse and distributed credential attacks. IP reputation geo-fencing VPN detection Tor detection CH·USR ### User Behavior Session duration, access times, resource access patterns, and privilege escalation attempts are monitored continuously throughout the session — not just at login. anomaly detection continuous auth privilege monitoring Core App Services ## Risk, Advice, Authentication — All Three. In the order they run: signals are scored into a risk tier, one universal endpoint turns that into advice — ALLOW, STEP\_UP, or DENY — and authentication executes the step-up when the answer is "prove you're you." SVC 01 ### Risk Intelligence First in the chain — the signal aggregation and policy engine behind every advice call. Ingests device, behavioral, network, and user signals; weighs them against tenant policy and resource sensitivity; returns a tier — `low`, `medium`, `high` — with a per-tier decision. Signal Aggregation Tenant Policy Risk Tiers Zero Trust SVC 02 ### Universal Risk Advice One endpoint — `POST /v1/advice` — turns the risk tier into a decision for any journey. Login, checkout, transfer, profile change, sensitive read: send a `transaction_ctx` and a `device_ctx`, get back ALLOW, STEP\_UP with a required ACR, or DENY. No flow-by-flow integration. /v1/advice transaction\_ctx device\_ctx ACR-aware multi-tenant SVC 03 ### Adaptive Authentication Last — execution. A full OIDC provider with risk-aware step-up: when `/v1/advice` returns STEP\_UP, the authenticator service dispatches the right challenge — passkey, push, TOTP, SMS, or magic link — and the session is upgraded with the achieved ACR. Every factor a user binds, including a verified **mobile driver's license**, is one inventory across the account. OIDC Passkeys / FIDO2 mDL / Verified ID TOTP Push SMS Magic Link In Production ## Three ways teams ship X-Auth for Apps. The same OIDC provider, dropped in three ways — managed login and sessions, login plus on-demand step-up, or risk-based step-up where the app **describes a transaction** and X-Auth names the **protection level** and decides the challenge. On-demand and risk-based step-up are live today on XentraNET products; managed login is rolling out on Steamparks. Use case 01 · Login & sessions ### Managed login — social & phone, sessions handled. Rolling out on [Steamparks](https://steamparks.org/) — hosted login for a roles & access platform (in build). Hand X-Auth your sign-in and you're done. The hosted `/login` chooser lets users pick **Google** or their **phone number**; X-Auth verifies them, mints the session, and rotates tokens. No password store, no SMS plumbing, no session bugs to own. 1. **Hosted chooser** — user picks Google or phone at `/login`. 2. **Verify** — social sign-in or SMS one-time code, on X-Auth's UI. 3. **Session minted** — OIDC code + PKCE returns access, ID & rotating refresh tokens. 4. **Stay signed in** — silent refresh; one revoke kills the whole token family. Hosted /login Google Phone / SMS OTP OIDC + PKCE Session management Rotating refresh Use case 02 · On-demand step-up ### Social login, then prove it for what matters. Live on [CryptoFreight](https://cryptofreight.org/) — on-chain freight settlement. Everyday access stays frictionless on a normal social login. The moment a user reaches something sensitive — a booking, the settlement ledger — X-Auth runs an **on-demand step-up**: a **passkey (FIDO2)** or an **SMS one-time code**, reusing the existing session so there's no second full login. The session is upgraded with the achieved ACR. 1. **Social login** — frictionless Google sign-in, low-risk session. 2. **Sensitive action** — the app requests an assurance level via `acr_values`. 3. **Step-up challenge** — passkey or SMS OTP, no re-login (session reuse). 4. **ACR upgraded** — the token carries the achieved assurance; the gate opens. Social login Passkeys / FIDO2 SMS OTP acr\_values Step-up Session reuse Use case 03 · Risk-based step-up ### Name the protection level — X-Auth decides if and how to challenge. Live on [Unlimited Freight](https://unlimitedfreight.com/) — enterprise AI agents for freight ops. Instead of asking for a specific method, the app states the **assurance an action needs** — one of **eight protection levels** — on the `acr_values` of an authenticated request. X-Auth returns the advice: **pass through** when the session already meets the bar, or run the **right challenge** when it doesn't. Levels are role- and action-aware: a routine read might sit at `high:protected`, while moving money is gated at `ultra:strict`. The session remembers the assurance it reaches, so equal-or-lower actions stay frictionless. High risk — protected actions `1urn:xauth:protect:high:protected` `2urn:xauth:protect:high:enhanced` `3urn:xauth:protect:high:restricted` `4urn:xauth:protect:high:strict` Ultra-high risk — finance & critical `5urn:xauth:protect:ultra:protected` `6urn:xauth:protect:ultra:enhanced` `7urn:xauth:protect:ultra:restricted` `8urn:xauth:protect:ultra:strict` 1. **Name the bar** — the app tags an action with a protection level via `acr_values` on `/authorize`. 2. **X-Auth advises** — pass through if the session already satisfies the level, otherwise step-up. 3. **Right challenge** — SMS OTP, passkey/FIDO2, escalating to the strongest for `ultra:strict`. 4. **Assurance recorded** — the token carries the achieved `acr`; equal-or-lower actions pass through. 8 protection levels acr\_values Risk-based Pass-through Role & action aware Finance → ultra:strict Verified Identity ## Verify the human. Trust the authenticator. Step-up proves possession of a factor. X-Auth goes further — it can verify a real government ID from the user's phone wallet, and it knows exactly which authenticator sits behind every passkey. Two new services, live in production. VID·MDL ### Mobile Driver's License Verify a real, government-issued **mobile driver's license** straight from the user's phone wallet over **ISO/IEC 18013-5 / -7** and OpenID4VP. X-Auth cryptographically checks the issuer chain, extracts the verified claims — name, date of birth, document number — and records the **issuing authority as the trust anchor** of the verification. Live at `id.x-auth.com`. ISO 18013-5 / -7 OpenID4VP issuer trust anchor selective claims VID·ENROLL ### Self-Service Enrollment Users add their own mDL — no admin in the loop. They authenticate with a social login first, then present from their wallet **same-device or by QR**. Enrollment is offered at three points: a shareable per-tenant link, during workspace signup, and as an optional prompt on first social login. **Per-tenant opt-in** keeps the default flow untouched until an admin enables it. same-device + QR social-login bound per-tenant opt-in no admin step VID·FIDO ### FIDO Authenticator Assurance Not every passkey is equal. X-Auth's **FIDO Metadata Service** checks each WebAuthn credential against the live **FIDO Alliance MDS** — resolving the authenticator by AAGUID to its make, certification level, and any published security advisories. Know whether a credential came from a certified hardware key or an unknown platform authenticator. Live at `fido.x-auth.com`. FIDO2 MDS AAGUID lookup attestation certification level VID·INV ### One Authenticator Inventory A verified mDL becomes a first-class authenticator on the account, shown **alongside SMS and FIDO passkeys** on the admin and owner screens. Every factor bound to a user — phone, passkey, verified ID — sits in one inventory, each carrying the trust anchor it was verified against. unified view SMS · FIDO · mDL trust anchor recorded admin & owner Product 02 · For Agents ## Your agents deserve their own identities. An MCP-native identity broker at `mcp.x-auth.com`. Real, scoped, revocable identities for every agent you deploy. The Agent Identity Crisis ## Shared Keys. Blast Radius. Your AI agents are running with credentials they shouldn't have — and you have no audit trail when things go wrong. > "Which agent made this API call? Under whose authority? With what scope? And how do I revoke just _that one_ without breaking the others?" That's your security team. Staring at a shared service account used by a dozen agent workloads. One prompt injection away from a breach. One audit query away from a compliance finding. Today's agents check into systems using credentials borrowed from humans, API keys with superuser scope, or a shared service account that can't be scoped down without breaking something. **None of that is identity — it's a backdoor with a sticker on it.** X-Auth for Agents gives every MCP connection a real identity, pre-scoped to the minimum claims it needs, drawn from a pool you manage. Revoke one without touching the others. Audit every connection. Sleep at night. How It Works ## Personas. Pools. One MCP Install. Three primitives. Define once in the X-Auth console, consume from any AI chat or agent runtime. STEP 01 ### Define Personas A **persona** is a pre-authorized bundle of claims — OAuth scopes, entitlements, attributes. Defined once by your security team, reused across every agent that takes on that role. persona: "crm-reader" scopes: - crm.contacts.read - crm.accounts.read ttl: 15m STEP 02 ### Provision Identity Pools An **identity pool** holds concrete agent identities eligible to assume one or more personas. Size the pool to your workload. Assign, rotate, revoke — per-identity, without collateral damage. pool: "support-desk-agents" size: 25 personas: - crm-reader - tickets-writer STEP 03 ### Install. Pick a Persona. OIDC. The AI chat owner installs `mcp.x-auth.com` as a tool and picks the persona they need. A standard OIDC handshake runs — X-Auth binds an identity from the pool and grants exactly the scopes the persona authorizes. The connection embodies that identity for its lifetime. install: mcp.x-auth.com persona: crm-reader handshake: oidc scopes: - crm.contacts.read - crm.accounts.read \# → identity bound, tokens issued Broker Capabilities ## Every Agent. Its Own Identity. The broker handles the identity lifecycle so your agent runtime doesn't have to. MCP-native from day one. BRK·PERSONA ### Persona Templates Codify the OAuth scopes and claim bundles your agents are allowed to assume. Version them, review them, sign them. Your security team owns what "agent authority" means — the agents don't negotiate it at runtime. OAuth scopes claim bundles policy-as-code BRK·POOL ### Identity Pools Real, concrete identities — not stamped-out JWTs. Assign pool size to workload volume, set per-identity TTLs, rotate or retire individuals without taking down the fleet. Scope each pool to one or more personas. per-workload pools individual rotation blast-radius limiting BRK·MCP ### MCP-Native Delivery Install `mcp.x-auth.com` as a tool in Claude, ChatGPT, Cursor, or any MCP-aware runtime. Pick a persona at install — the OIDC handshake binds an identity from the pool. If your runtime supports **DCR** (Dynamic Client Registration) or **CIMD** (Client Identifier Metadata Document), install is truly zero-config — no manual client provisioning, no copy-pasted secrets. DCR CIMD OIDC Claude · ChatGPT · Cursor BRK·AUDIT ### Audit & Revocation Every MCP connection is logged with the requesting runtime, the selected persona, the pool, and the bound identity. Revoke a live connection mid-session. Trace any downstream API call back to the exact agent, persona, and time window. per-connection log instant revocation forensic trace Standards-Aligned · Live ## Built on ID-JAG. Both sides of Okta Cross App Access. X-Auth implements the IETF **Identity Assertion Authorization Grant** (ID-JAG) — the open standard behind Okta's **Cross App Access (XAA)** — on **both sides of the trust**. As the **IdP**, X-Auth exchanges a user token for a signed, scoped assertion (RFC 8693 token exchange), minted only for MCP servers a tenant admin has authorized — no per-tool consent loop. As the **resource authorization server**, X-Auth redeems assertions from identity providers a tenant trusts — other X-Auth workspaces or any XAA-capable IdP — for short-lived Bearer access tokens (RFC 7523 `jwt-bearer`), each assertion accepted exactly once. Both grants are advertised on the discovery document. \# Leg 1 — the IdP mints an assertion (RFC 8693 token exchange) POST /token grant\_type: urn:ietf:params:oauth:grant-type:token-exchange requested\_token\_type: urn:ietf:params:oauth:token-type:id-jag subject\_token: resource: https://mcp.acme.com \# must be on the tenant allow-list scope: crm.contacts.read \# → 300s ID-JAG (typ: oauth-id-jag+jwt), aud = the resource \# Leg 2 — the resource's AS redeems it (RFC 7523 jwt-bearer) POST /token grant\_type: urn:ietf:params:oauth:grant-type:jwt-bearer assertion: \# → scoped Bearer access token — issuer must be on the tenant's \# trusted-IdP registry; single-use jti; no refresh token XAA·USER ### No Consent Fatigue Users stop seeing repetitive OAuth approval screens for every AI tool integration. The IdP issues a signed identity assertion once; downstream apps verify it without dragging the user back into a consent loop. signed assertions no consent loops user-invisible XAA·GOV ### Centralized Governance IT enforces least-privilege access from one place. Monitor every trust relationship between agents, personas, and downstream apps. Revoke instantly across all connected services — no per-app cleanup. least-privilege trust visibility instant revocation XAA·AUDIT ### Centralized Audit Every access event — assertion issued, token exchanged, resource called — logs to one place. SOC 2, HIPAA, and GDPR auditors get a single pane of glass for non-human identity activity across your fleet. SOC 2 HIPAA GDPR Compliance & Trust Center ## Built for Regulated Industries From fintech startups to enterprise infrastructure — X-Auth is the foundation of digital trust. SOC 2 Type II ISO 27001 GDPR Ready HIPAA Compliant PCI DSS Zero instances of unauthorized access reported by X-Auth clients Pricing ## Start Free. Scale Confidently. No credit card required on either product's Developer tier. Pick the surface you're starting with — or use both. X-Auth for Apps ### Human identity, billed by MAU. Risk-based OIDC for the users of your app. All tiers include the full risk engine. Developer Free forever For side projects and early-stage MVPs. Up to 5,000 MAU. - Up to 5,000 monthly active users - Risk-based authentication - Passwordless & social login - Basic RBAC - Community support [Get Started Free](#contact) MOST POPULAR Growth Custom / mo For production apps requiring advanced risk scoring and priority support. - Unlimited monthly active users - Advanced behavioral biometrics - Full RBAC + ABAC policy engine - ATO protection & bot mitigation - Analytics dashboard - Priority support SLA [Request Pricing](#contact) Enterprise Custom / yr Dedicated infrastructure, custom throughput, and 24/7 security response. - Dedicated cluster deployment - Custom risk policy engine - SSO & SCIM provisioning - Compliance reporting - SLA guarantees - 24/7 security response team [Contact Sales](#contact) X-Auth for Agents ### Agent identity, billed by pool & personas. Provision real identities for your AI agents. Tiers scale on concurrent agent identities, distinct personas, and MCP installs. Developer Free forever For exploring MCP-based identity brokering and small personal agents. - 2 concurrent agent identities - 2 personas (claim bundles) - Up to 2 MCP installs - Basic audit log (7-day retention) - Community support [Get Started Free](#contact) MOST POPULAR Growth Custom / mo For teams running production agent workloads across multiple personas and runtimes. - Scalable identity pools - Multiple personas with approval workflows - Multi-runtime MCP installs - Full audit log (90-day retention) - Instant revocation & rotation - Priority support SLA [Request Pricing](#contact) Enterprise Custom / yr For regulated deployments needing dedicated broker infrastructure and custom policy controls. - Unlimited identities & personas - Dedicated broker cluster - Private MCP endpoint & mTLS - SIEM audit export - SSO admin, SCIM, policy-as-code - 24/7 security response team [Contact Sales](#contact) Get in Touch ## Ready When You Are. Free-tier signups, sales questions, security reviews — we reply the same business day. ### Start your free workspace Enter your company name. You'll sign in with Google to create your tenant and OIDC client. Company name Continues at `auth.x-auth.com`.