Skip to main content

What is LumoAuth?

LumoAuth is a multi-organization identity and access management (IAM) platform. It handles authentication, authorization, and identity management from a single service, so applications do not have to implement these themselves.

Functionally, LumoAuth covers the same ground as Auth0, Okta, or Keycloak. It implements the standard protocols — OAuth 2.0, OpenID Connect, SAML 2.0, SCIM 2.0 — and adds adaptive MFA, fine-grained authorization (Zanzibar-style), and first-class identity for AI agents.

Who is LumoAuth for?​

Use caseDescription
Multi-customer SaaSMulti-organization applications where each customer gets an isolated environment (users, branding, settings).
B2C applicationsConsumer apps that need social login, passwordless, and MFA.
EnterpriseIntegrations with Active Directory, SAML IdPs, and enforcement of compliance policies.
Internal toolsProtected internal APIs and dashboards with RBAC and audit logging.
AI and automationVerified identities for AI agents and autonomous workloads.

Feature summary​

Authentication​

  • Email and password — standard credential login with email verification
  • Social login — Google, GitHub, Microsoft, Facebook, Apple, LinkedIn, and custom OIDC providers
  • Multi-factor authentication (MFA) — passkeys, LumoAuth app push with number matching, authenticator apps (TOTP), text-message and email codes, and recovery codes
  • Adaptive MFA — risk scoring that triggers MFA only when needed
  • Passkeys / WebAuthn — FIDO2 passwordless login
  • Enterprise SSO — SAML 2.0 (as IdP and SP), OIDC federation, LDAP / Active Directory
  • Device authorization (sign in on another device) — for CLI tools and input-constrained devices

Multi-tenancy​

  • Data isolation — each organization has its own users, roles, permissions, and OAuth clients
  • Organization portal — self-service admin dashboard at /orgs/{orgId}/portal/
  • Custom domains — branded login pages on your own domain
  • Per-organization configuration — independent auth settings, social providers, email templates

Authorization and access control​

  • Role-Based Access Control (RBAC) — roles grouping named permissions
  • Groups — collections of users that inherit roles
  • Attribute-Based Access Control (ABAC) — context-aware policies (time, IP, resource attributes)
  • Fine-grained authorization (Zanzibar) — relationship-based access control, modeled on Google's Zanzibar paper
  • AI policy authoring — describe a policy in natural language; LumoAuth translates it into enforceable rules
  • Test access — check what a specific user is allowed to do, under roles, attribute rules or relationships, in real time

Standards and protocols​

  • OAuth 2.0 — authorization code, client credentials, device code, refresh token, CIBA
  • OpenID Connect — discovery, dynamic client registration, custom claims
  • SAML 2.0 — acts as both Identity Provider (IdP) and Service Provider (SP)
  • SCIM 2.0 — user and group provisioning
  • Sender-constrained tokens (DPoP) — ties a token to the client's key so a stolen copy cannot be replayed
  • Pushed authorization requests (PAR) — the app sends the sign-in request to the server first, so it cannot be tampered with in the browser
  • Rich authorization requests — structured, fine-grained descriptions of what a token may do

Compliance and security​

  • GDPR — data subject requests, consent tracking, data export, breach reporting
  • Audit logs — append-only record of every operation
  • Rate limiting — per-endpoint protection against brute-force and abuse
  • Signing key management — JWT key rotation, JWKS endpoints, multiple active keys

Integrations​

  • Webhooks — event notifications for user-lifecycle events
  • Observability — log sinks that stream audit events to Datadog, Axiom, Honeycomb and other destinations
  • Email templates — customizable transactional emails (welcome, verification, password reset, MFA)
  • SDKs — JavaScript/TypeScript (including React, Next.js and Express packages), Python (with FastAPI and agent extras), Go, PHP (with Symfony and Laravel packages), Java (with a Spring Boot starter) and .NET (with ASP.NET Core), plus generated API clients for the same languages and Ruby, Rust and Swift

AI and automation​

  • Workload identity — register and authenticate autonomous AI agents
  • Model Context Protocol (MCP) — authorize LLM tool calls and agent actions
  • JIT provisioning — create user accounts on the fly from external IdPs

Architecture overview​

Next steps​

Standards used on this page​

Plain nameStandard
Device authorization (sign in on another device)RFC 8628
SCIM 2.0 (user and group provisioning)RFC 7642, RFC 7643 and RFC 7644
Sender-constrained tokens (DPoP)RFC 9449
Pushed authorization requests (PAR)RFC 9126
Rich authorization requestsRFC 9396

See the standards reference for what each one covers and how LumoAuth uses it.