LumoAuth Docs
LumoAuth is the Identity Layer for the Agentic Era — authentication, authorization, and identity management for AI agents and traditional applications alike.
Base URL
API endpoints are relative to your tenant's base URL:
https://app.lumoauth.dev/t/\{tenantSlug\}/api/v1/
Base hostname for EU is https://eu.app.lumoauth.dev
Choose Your Path
🤖 Securing AI Agents
Give your AI agents verified identities, scoped capabilities, and auditable authorization. No shared API keys — each agent gets its own cryptographic identity with delegation and just-in-time approval built in.
⚡ Securing Your Application
Add OAuth 2.0 login, passkeys, enterprise SSO, adaptive MFA, and fine-grained RBAC to your web or mobile app — with SDKs for React, Node.js, and Python.
Get Started with Applications →
Platform Capabilities
| Capability | Description |
|---|---|
| AI Access Control | Access control built for AI agents — workload identity federation, AAuth protocol, capability scoping, and delegation for autonomous AI agents |
| The Ask API | Natural language-friendly authorization optimized for LLM reasoning loops |
| JIT Permissions | Human-in-the-loop approval flows for sensitive agent operations |
| MCP Servers | Authorize Model Context Protocol tool calls and agent actions |
| Chain of Agency | RFC 8693 token exchange enabling agents to act on behalf of users, with full audit trail |
| Authorization API | Fine-grained permission checks using RBAC, ABAC, and Google Zanzibar-style ReBAC |
| OAuth 2.0 & OIDC | Industry-standard flows for web and mobile apps |
| Enterprise SSO | SAML 2.0, OIDC federation, and Active Directory integrations |
| Multi-Tenant Architecture | Complete isolation of users, roles, and configurations per tenant |
| Zanzibar ReBAC | Google-style relationship-based access control for fine-grained permissions |
| Passkeys & WebAuthn | FIDO2 passwordless authentication and device-bound credentials |
| SCIM 2.0 | Automated user and group provisioning for enterprise directory sync |
Getting Help
If you run into issues or have questions:
- Check the Error Codes reference for troubleshooting
- Each endpoint page includes detailed examples and common use cases