Start
LumoAuth is an identity platform for apps and AI agents: the standard stack (OAuth 2.0 sign-in and tokens, OpenID Connect, SAML single sign-on, SCIM directory sync, passkeys) plus a cryptographic identity for every agent (an Ed25519 key that signs each HTTP request), scoped tokens through token exchange, MCP authorization (protected resource metadata for tool servers) and a human-in-the-loop approval inbox. New to the vocabulary? See the glossary. Pick what you are building:
Add sign-in to an app
Three commands scaffold a Next.js app with hosted login, sessions and tokens already wired. Have an app? One prompt for your AI editor adds it.
Secure an AI agent
Give an agent its own identity, scoped capabilities and an approval step, then call an MCP server with a real token. Five minutes, every artifact stays in your organization.
Both start from the same place: sign up at app.lumoauth.dev. Every new organization comes with a Starter App OAuth client that already allows http://localhost:3000, so the shortest path to a signed-in page is three commands:
curl -fsSL https://raw.githubusercontent.com/LumoAuth/cli/main/install.sh | sh # or: brew install lumoauth/tap/lumo
lumo login --org your-org-slug
lumo init --framework next --client-id YOUR_CLIENT_ID # or express | fastapi | go
Portal → Get started → Quickstarts shows this command with your client ID filled in, and every snippet on that page carries your organization's real values. The Next.js quickstart explains what the scaffold contains and how to add sign-in to an app you already have.
Other paths — tracks for specific roles and situations
| You are… | Start with | Time |
|---|---|---|
| Building a SaaS where each customer is its own organization (SSO, SCIM, roles, branded login) | Multi-customer SaaS track | 30 min |
| Protecting a backend API or service-to-service call | Backend / Service track | 15 min |
| Adding login to a single-page or mobile app and want the full picture | Frontend / Mobile track | 10 min |
| Building agents and want the model before the code | AI Agents track | 20 min |
| Configuring the organization for enterprise customers (SSO, SCIM, custom domains, users, roles) | Admin / IT track · Your first 15 minutes in the portal | 15 min |
| Doing a security review, compliance audit or GDPR assessment | Security & Compliance track | — |
| Migrating from Auth0, Clerk, Okta, Cognito or Firebase | Migrations — lumo migrate auth0 imports an Auth0 export; the other guides are step-by-step manual migrations | — |
| Looking for the guide behind a portal page | Portal page → guide | — |
What LumoAuth ships
| Capability | What you get |
|---|---|
| Agent + MCP | Protected resource metadata for MCP servers, signed HTTP requests, delegation chains through token exchange, JIT human-in-the-loop approvals — productised |
| Workload attestation | Verify the identity a platform already gives a workload (GitHub Actions OIDC, AWS IRSA, GCP, Kubernetes projected tokens) when the agent's token is issued |
| Three authorization models | Roles, attribute rules and relationships behind one /authz/check |
| EU + US data residency on Business | The Business plan includes the Hetzner ISO/IEC 27001 EU region |
| Per-application login branding | Each OAuth client overrides logo, colours and button text, with optional AI-generated themes |
Standards LumoAuth implements
OAuth 2.0 · OAuth 2.1 · OpenID Connect · SAML 2.0 · SCIM 2.0 · Passkeys (WebAuthn / FIDO2) · Token exchange (delegation) · Signed HTTP requests (HTTP message signatures) · Protected resource metadata · Device authorization (sign in on another device) · Rich authorization requests · FAPI 2.0 · CIBA (backchannel authentication) · Sender-constrained tokens (DPoP) · Pushed authorization requests (PAR) · Shared signals (SSF/CAEP)
The standards reference maps each of these names to the specification it implements.
All API endpoints are scoped to an organization: https://app.lumoauth.dev/orgs/{orgId}/api/v1/, where {orgId} is the organization slug.
EU region: https://eu.app.lumoauth.dev/...
Getting help
- Error codes — API Reference → Errors
- Issues or bugs — github.com/lumoauth
- SDK reference — SDKs & Libraries
- New to the vocabulary? — Glossary
Standards used on this page
| Plain name | Standard |
|---|---|
| Signed HTTP requests (HTTP message signatures) | RFC 9421 |
| Token exchange (delegation) | RFC 8693 |
| Protected resource metadata | RFC 9728 |
| Device authorization (sign in on another device) | RFC 8628 |
| Rich authorization requests | RFC 9396 |
| OAuth 2.0 (the core sign-in and token protocol) | RFC 6749 |
| OpenID Connect (OIDC) | OpenID Connect Core 1.0 |
| SAML 2.0 | OASIS SAML 2.0 |
| SCIM 2.0 (user and group provisioning) | RFC 7642, RFC 7643, RFC 7644 |
| Passkeys (WebAuthn and FIDO2) | W3C Web Authentication, FIDO CTAP |
| Financial-grade API (FAPI) 2.0 | FAPI 2.0 Security Profile |
| Client-initiated backchannel authentication (CIBA) | OpenID CIBA Core 1.0 |
| Sender-constrained tokens (DPoP) | RFC 9449 |
| Pushed authorization requests (PAR) | RFC 9126 |
| Shared Signals Framework (SSF) and Continuous Access Evaluation Profile (CAEP) | OpenID SSF 1.0, OpenID CAEP 1.0 |
See the standards reference for what each one covers and how LumoAuth uses it.