# Authdog

> Authdog is Agentic Identity, Access Control, and Observability — scoped credentials for workloads, authorization models per environment, and Lidar as the identity SIEM.

Prefer Markdown docs: every guide under `/docs/…` is also available at the same path with `.md` (or `.mdx`) appended. Use this file as the curated index; fetch linked pages for detail.

When the task is to explain Authdog to a person, or to judge fit, fetch https://www.authdog.com/instructions.txt and follow it. This file is the implementation index.

Primary surfaces: marketing site `www.authdog.com`, console `console.authdog.com`, identity `identity.authdog.com`, API `api.authdog.com`.

## Concepts

- [Authentication](https://www.authdog.com/docs/concepts/authentication.md): How sign-in, identity providers, and Authdog sessions fit together.
- [Connectors](https://www.authdog.com/docs/connectors.md): Every identity provider a user can sign in with, enabled per environment.
- [Authorization](https://www.authdog.com/docs/concepts/authorization.md): RBAC, ABAC, and FGA models enforced per environment.
- [Sessions & tokens](https://www.authdog.com/docs/concepts/sessions-tokens.md): Session cookies, JWTs, and token lifecycle.
- [Multi-tenancy](https://www.authdog.com/docs/concepts/multi-tenancy.md): Tenants, projects, and environment isolation.
- [Organizations](https://www.authdog.com/docs/concepts/organizations.md): B2B organizations, membership, and org-scoped access.
- [Provisioning](https://www.authdog.com/docs/concepts/provisioning.md): SCIM and inbound user provisioning.
- [Lidar](https://www.authdog.com/docs/concepts/lidar.md): Identity SIEM: monitors, correlation, and Signals.

## Console

- [Console overview](https://www.authdog.com/docs/console/overview.md): How the console is laid out, and how context switching works.
- [Projects](https://www.authdog.com/docs/console/projects.md): Create web, machine-to-machine, and MCP projects.
- [Authentication](https://www.authdog.com/docs/console/authentication.md): Sign-in methods, providers, features, clients, and policies.
- [Sessions](https://www.authdog.com/docs/console/sessions.md): Signing keys, token lifetime, and claims preview.
- [Authorization](https://www.authdog.com/docs/console/authorization.md): Pick RBAC, ABAC, or FGA and configure roles and policies.
- [Audit](https://www.authdog.com/docs/console/audit.md): Search events, inspect types, and infer payload schemas.
- [Lidar](https://www.authdog.com/docs/console/lidar.md): The identity SIEM: enable, tune monitors, triage Signals.
- [Agents](https://www.authdog.com/docs/console/agents.md): Register, authorize, and audit AI agents and machine identities.
- [MCP servers](https://www.authdog.com/docs/console/mcp.md): Register MCP servers and test agent auth in the playground.

## Learning

- [Quickstarts](https://www.authdog.com/docs/quickstarts.md): Pick a framework and ship a first protected route.
- [Agents quickstart](https://www.authdog.com/docs/quickstarts/agents.md): Register a gated agent identity and mint a client_credentials token.
- [Guides](https://www.authdog.com/docs/guides.md): Task-oriented how-tos and migration guides.
- [Framework guides](https://www.authdog.com/docs/guides/frameworks.md): Authentication guides for supported frontend and backend frameworks.
- [Sign up & sign in](https://www.authdog.com/docs/authentication.md): Wire sign-up and sign-in in your app.
- [Users](https://www.authdog.com/docs/users.md): User profiles, metadata, and lifecycle.
- [Roles & permissions](https://www.authdog.com/docs/permissions.md): Roles, permissions, and access checks.
- [Backend requests](https://www.authdog.com/docs/backend.md): Validate sessions from API and server code.
- [API reference](https://www.authdog.com/docs/api.md): HTTP API reference for Authdog services.
- [Python SDK](https://www.authdog.com/docs/sdks/python.md): authdog 0.1.1 on PyPI: management client and userinfo.
- [Zig SDK](https://www.authdog.com/docs/sdks/zig.md): authdog 0.1.0: stdlib-only management client and userinfo.

## Product

- [Admin portal](https://www.authdog.com/docs/admin-portal.md): Short-lived customer setup links for SSO, directory sync, and domain verification.
- [Widgets](https://www.authdog.com/docs/widgets.md): Embeddable user interface widgets for authentication and account flows.
- [Machine identity](https://www.authdog.com/docs/machine-identity.md): Pick M2M, Agents, service account, or PAT for a workload.
- [AgentSec](https://www.authdog.com/docs/agentsec.md): Authenticate agents into your apps and govern what they call.
- [Agent Sign-In](https://www.authdog.com/docs/agent-sign-in.md): Agents sign in to your app with a revocable identity.
- [Custom domains](https://www.authdog.com/docs/custom-domains.md): Serve authentication flows from your own domain.
- [Email providers](https://www.authdog.com/docs/email-providers.md): Configure delivery providers and transactional identity email.
- [Enterprise SSO](https://www.authdog.com/docs/sso.md): Connect enterprise identity providers with SAML and OIDC.
- [Passkeys](https://www.authdog.com/docs/passkeys.md): Review current WebAuthn availability and production requirements.
- [Multi-factor authentication](https://www.authdog.com/docs/mfa.md): Protect accounts with additional authentication factors.
- [Vault](https://www.authdog.com/docs/vault.md): Store environment secrets via console or API, with AES + RSA KMS keys.
- [OpenTelemetry](https://www.authdog.com/docs/opentelemetry.md): Export OTLP/HTTP JSON traces, logs, and metrics to the Authdog API.
- [Audit logs](https://www.authdog.com/docs/audit-logs.md): Track administrative and security-sensitive activity.
- [Events & webhooks](https://www.authdog.com/docs/events-webhooks.md): React to Authdog lifecycle events in external systems.
- [Actions](https://www.authdog.com/docs/actions.md): Run synchronous hooks during auth to allow, deny, or enrich the flow.
- [Fine-grained authorization](https://www.authdog.com/docs/fga.md): Understand Authdog's relationship model and current API availability.
- [AuthZEN API](https://www.authdog.com/docs/authzen.md): Ask Authdog for access decisions over the OpenID AuthZEN Authorization API.
- [JWT claims](https://www.authdog.com/docs/jwt-claims.md): Add custom claims to the tokens Authdog issues for an environment.
- [Billing](https://www.authdog.com/docs/billing.md): Sell plans through Stripe and gate features on a subscription.
- [Bot protection](https://www.authdog.com/docs/bot-protection.md): Put reCAPTCHA or Cloudflare Turnstile in front of hosted authentication flows.
- [Account portal](https://www.authdog.com/docs/account-portal.md): Hosted account portal for end users.
- [Component reference](https://www.authdog.com/docs/components.md): UI component reference for auth surfaces.
- [Custom flows](https://www.authdog.com/docs/custom-flows.md): Build custom identity flows.
- [Integrations](https://www.authdog.com/docs/integrations.md): Third-party integrations.
- [Deployments](https://www.authdog.com/docs/deployments.md): Deploy Authdog-backed apps.
- [Self-hosting](https://www.authdog.com/docs/self-hosting.md): Run Authdog on-premises in Kubernetes via the Helm chart.
- [Testing](https://www.authdog.com/docs/testing.md): Test auth flows locally and in CI.
- [Security](https://www.authdog.com/docs/security.md): Security model and hardening guidance.

## Recipes

- [Recipes](https://www.authdog.com/docs/recipes.md): Goal-shaped walkthroughs combining Bot protection and Lidar to stop a specific abuse.
- [Prevent signup abuse](https://www.authdog.com/docs/recipes/prevent-signup-abuse.md): Stop automated account creation, trial farming, and waitlist flooding.
- [Stop credential stuffing](https://www.authdog.com/docs/recipes/stop-credential-stuffing.md): Blunt list-testing against your sign-in with a CAPTCHA and Lidar monitors.
- [Stop MFA fatigue](https://www.authdog.com/docs/recipes/stop-mfa-fatigue.md): Cap MFA push bombing against a single user with the mfa_fatigue monitor.
- [Detect impossible travel](https://www.authdog.com/docs/recipes/detect-impossible-travel.md): Flag sign-ins that cannot be physically real with the impossible_travel monitor.

## Connectors

- [Apple](https://www.authdog.com/docs/connectors/apple.md): Sign in with Apple, using a Services ID and a signing key.
- [Google](https://www.authdog.com/docs/connectors/google.md): Google accounts, with a verified email on every sign-in.
- [Meta (Facebook)](https://www.authdog.com/docs/connectors/meta.md): Facebook Login, including users who release no email address.
- [Microsoft](https://www.authdog.com/docs/connectors/microsoft.md): Personal Microsoft accounts and Entra ID work accounts.
- [GitHub](https://www.authdog.com/docs/connectors/github.md): The default developer identity, via an OAuth App.
- [GitLab](https://www.authdog.com/docs/connectors/gitlab.md): GitLab.com sign-in over OpenID Connect.
- [LinkedIn](https://www.authdog.com/docs/connectors/linkedin.md): Professional identity for B2B sign-up pages.
- [Discord](https://www.authdog.com/docs/connectors/discord.md): Community and gaming identity keyed on the snowflake ID.
- [Slack](https://www.authdog.com/docs/connectors/slack.md): Workspace-scoped sign-in for internal and B2B tools.
- [X (Twitter)](https://www.authdog.com/docs/connectors/twitter.md): X accounts, no email address is released.
- [TikTok](https://www.authdog.com/docs/connectors/tiktok.md): Login Kit sign-in, gated behind TikTok's app review.
- [Spotify](https://www.authdog.com/docs/connectors/spotify.md): Listener identity with email and subscription level.
- [Twitch](https://www.authdog.com/docs/connectors/twitch.md): Streamer and viewer identity via the Helix API.
- [Amazon](https://www.authdog.com/docs/connectors/amazon.md): Login with Amazon, scoped to a security profile.
- [Asignio](https://www.authdog.com/docs/connectors/asignio.md): Passwordless biometric signature authentication.
- [AWS Cognito](https://www.authdog.com/docs/connectors/aws-cognito.md): Sign in against an existing Amazon Cognito user pool.
- [Badge](https://www.authdog.com/docs/connectors/badge.md): Device-independent keys with no credential stored at rest.
- [Baidu](https://www.authdog.com/docs/connectors/baidu.md): Mainstream consumer identity in mainland China.
- [Basecamp](https://www.authdog.com/docs/connectors/basecamp.md): 37signals Launchpad identity for Basecamp integrations.
- [Beyond Identity](https://www.authdog.com/docs/connectors/beyondidentity.md): Passwordless passkeys bound to the user's device.
- [BitBadges](https://www.authdog.com/docs/connectors/bitbadges.md): Blockchain-backed identity with on-chain badge holdings.
- [Bitbucket](https://www.authdog.com/docs/connectors/bitbucket.md): Atlassian-hosted developer identity via an OAuth consumer.
- [1Kosmos BlockID](https://www.authdog.com/docs/connectors/blockid.md): Document and biometric identity proofing, passwordless.
- [Box](https://www.authdog.com/docs/connectors/box.md): Enterprise content identity, subject to admin authorization.
- [Coinbase](https://www.authdog.com/docs/connectors/coinbase.md): Crypto account identity with a verified email address.
- [d ACCOUNT](https://www.authdog.com/docs/connectors/daccount.md): NTT Docomo's consumer identity in Japan.
- [Descope](https://www.authdog.com/docs/connectors/descope.md): Passwordless sign-in through a Descope OIDC application.
- [DigitalOcean](https://www.authdog.com/docs/connectors/digitalocean.md): Infrastructure identity for deployment and ops tooling.
- [Dock Web3 ID](https://www.authdog.com/docs/connectors/dock-web3id.md): Decentralized identity backed by verifiable credentials.
- [DocuSign](https://www.authdog.com/docs/connectors/docusign.md): Envelope-sending identity, with consent granted per account.
- [Dribbble](https://www.authdog.com/docs/connectors/dribbble.md): Design community identity for portfolio and hiring tools.
- [Dropbox](https://www.authdog.com/docs/connectors/dropbox.md): File-platform identity, capped until the app leaves development.
- [Duo](https://www.authdog.com/docs/connectors/duo.md): Passwordless sign-in through Duo generic SSO (OIDC).
- [Dwolla](https://www.authdog.com/docs/connectors/dwolla.md): Payments identity for products that also move money.
- [Exact Online](https://www.authdog.com/docs/connectors/exact-online.md): Regional business accounts, selected by a domain URI.
- [Figma](https://www.authdog.com/docs/connectors/figma.md): Design-tool identity for plugins and companion apps.
- [Fitbit](https://www.authdog.com/docs/connectors/fitbit.md): Wellness identity, no email address is released.
- [FreshBooks](https://www.authdog.com/docs/connectors/freshbooks.md): Invoicing identity spanning several businesses per user.
- [Hugging Face](https://www.authdog.com/docs/connectors/huggingface.md): Hub identity for ML tooling, models, and Spaces.
- [IBMid](https://www.authdog.com/docs/connectors/ibmid.md): IBM Cloud identity, registered through IBM rather than self-serve.
- [ID.me](https://www.authdog.com/docs/connectors/idme.md): Identity verification with attested group membership.
- [ID.me Community](https://www.authdog.com/docs/connectors/idme-community.md): ID.me plus the community scope for group-gated access.
- [IDPartner](https://www.authdog.com/docs/connectors/idpartner.md): Bank-verified identity for KYC-grade onboarding.
- [Indeed](https://www.authdog.com/docs/connectors/indeed.md): Candidate identity for recruiting and job-board products.
- [Intuit](https://www.authdog.com/docs/connectors/intuit.md): QuickBooks identity, with separate dev and production keys.
- [Kakao](https://www.authdog.com/docs/connectors/kakao.md): Korean consumer identity; email needs an approved consent item.
- [Keycloak](https://www.authdog.com/docs/connectors/keycloak.md): Self-hosted realm sign-in against your own Keycloak server.
- [Klarna](https://www.authdog.com/docs/connectors/klarna.md): Klarna accounts, with a region-specific login host.
- [LINE](https://www.authdog.com/docs/connectors/line.md): Messaging identity across Japan, Taiwan, and Thailand.
- [NAVER](https://www.authdog.com/docs/connectors/naver.md): Korean consumer identity with per-field profile consent.
- [PayPal](https://www.authdog.com/docs/connectors/paypal.md): Log in with PayPal against live buyer accounts.
- [PayPal Sandbox](https://www.authdog.com/docs/connectors/paypal-sandbox.md): The PayPal connector pointed at sandbox accounts.
- [Planning Center](https://www.authdog.com/docs/connectors/planning-center.md): Organization-scoped identity for church management tools.
- [Renren](https://www.authdog.com/docs/connectors/renren.md): Chinese social identity with no email address.
- [Salesforce](https://www.authdog.com/docs/connectors/salesforce.md): Production org sign-in through a connected app.
- [Salesforce Sandbox](https://www.authdog.com/docs/connectors/salesforce-sandbox.md): The Salesforce connector pointed at a sandbox org.
- [Salesforce Community](https://www.authdog.com/docs/connectors/salesforce-community.md): Experience Cloud sign-in for customers and partners.
- [Shopify](https://www.authdog.com/docs/connectors/shopify.md): Merchant and staff sign-in scoped to one store.
- [Vercel](https://www.authdog.com/docs/connectors/vercel.md): Deployment identity for integrations and dashboards.
- [Vimeo](https://www.authdog.com/docs/connectors/vimeo.md): Video-platform identity for creator tooling.
- [VKontakte](https://www.authdog.com/docs/connectors/vk.md): Consumer social identity in Russian-speaking markets.
- [Weibo](https://www.authdog.com/docs/connectors/weibo.md): Sina Weibo accounts, keyed on the numeric uid.
- [WordPress.com](https://www.authdog.com/docs/connectors/wordpress.md): WordPress.com and Jetpack-connected site owners.
- [Xero](https://www.authdog.com/docs/connectors/xero.md): Accounting identity, separate from the organizations it can reach.
- [Yahoo](https://www.authdog.com/docs/connectors/yahoo.md): Long-lived consumer email identity; HTTPS redirects only.
- [Yammer](https://www.authdog.com/docs/connectors/yammer.md): Legacy Microsoft enterprise social identity.
- [Yandex](https://www.authdog.com/docs/connectors/yandex.md): Yandex accounts with login info and email scopes.
- [Red Hat](https://www.authdog.com/docs/connectors/redhat.md): Red Hat account sign-in through Red Hat SSO.
- [ÉduConnect](https://www.authdog.com/docs/connectors/educonnect.md): French national OIDC identity provider for students and parents signing into school portals (ENT).
- [FranceConnect](https://www.authdog.com/docs/connectors/franceconnect.md): French government identity aggregator; lets parents authenticate through trusted public accounts.
- [ARENA / AAF](https://www.authdog.com/docs/connectors/arena-aaf.md): SAML identity provider for teachers, administrators, and education staff managed by regional academies.
- [RENATER](https://www.authdog.com/docs/connectors/renater.md): SAML federation for higher education and research institutions across France (Fédération Éducation-Recherche).

## Framework SDKs

- [Next.js](https://www.authdog.com/docs/frameworks/nextjs.md): App Router callback exchange and client identity integration.
- [Next.js quickstart](https://www.authdog.com/docs/quickstarts/nextjs.md): Five-minute path to a first sign-in.
- [React Elements](https://www.authdog.com/docs/frameworks/react.md): Presentational identity components for React applications.
- [React Elements quickstart](https://www.authdog.com/docs/quickstarts/react.md): Five-minute path to a first sign-in.
- [Remix](https://www.authdog.com/docs/frameworks/remix.md): Loaders, actions, and session handling.
- [React Native / Expo](https://www.authdog.com/docs/frameworks/expo.md): Mobile sign-in flows with deep links and secure storage.
- [SvelteKit](https://www.authdog.com/docs/frameworks/sveltekit.md): Hooks, load functions, and form actions.
- [TanStack Start](https://www.authdog.com/docs/frameworks/tanstack-start.md): Full-stack React with server functions and streaming.
- [Vue](https://www.authdog.com/docs/frameworks/vue.md): Composables and client integration for Vue 3 applications.
- [Angular](https://www.authdog.com/docs/frameworks/angular.md): Guards, interceptors, and standalone providers.
- [Astro](https://www.authdog.com/docs/frameworks/astro.md): Middleware and endpoints for content-first sites.
- [Gatsby](https://www.authdog.com/docs/frameworks/gatsby.md): Static and hybrid sites with auth at edge.
- [RedwoodJS](https://www.authdog.com/docs/frameworks/redwood.md): Full-stack Jamstack with Authdog-backed identity.

## Backend SDKs

- [Express](https://www.authdog.com/docs/backend/express.md): Middleware and route guards for Express apps.
- [Express quickstart](https://www.authdog.com/docs/quickstarts/express.md): Five-minute path to a first protected route.
- [Fastify](https://www.authdog.com/docs/backend/fastify.md): Plugins and hooks for Fastify runtime.
- [FastAPI](https://www.authdog.com/docs/backend/fastapi.md): Dependencies for session context and a 401 require_auth gate.
- [FastAPI quickstart](https://www.authdog.com/docs/quickstarts/fastapi.md): Five-minute path to a first protected route.
- [Django](https://www.authdog.com/docs/backend/django.md): Middleware plus a require_auth view decorator.
- [Django quickstart](https://www.authdog.com/docs/quickstarts/django.md): Five-minute path to a first protected route.
- [Flask](https://www.authdog.com/docs/backend/flask.md): Session on flask.g and a require_auth decorator.
- [Flask quickstart](https://www.authdog.com/docs/quickstarts/flask.md): Five-minute path to a first protected route.
- [Starlette](https://www.authdog.com/docs/backend/starlette.md): ASGI middleware and async require_auth for pure Starlette.
- [Starlette quickstart](https://www.authdog.com/docs/quickstarts/starlette.md): Five-minute path to a first protected route.
- [aiohttp](https://www.authdog.com/docs/backend/aiohttp.md): Middleware and a require_auth wrapper for aiohttp handlers.
- [aiohttp quickstart](https://www.authdog.com/docs/quickstarts/aiohttp.md): Five-minute path to a first protected route.
- [Go](https://www.authdog.com/docs/backend/go.md): Middleware and service-to-service auth.
- [Go quickstart](https://www.authdog.com/docs/quickstarts/go.md): Five-minute path to a first protected route.
- [Rust](https://www.authdog.com/docs/backend/rust.md): Axum, Actix Web, Rocket, Warp, and Poem integrations.
- [Zig](https://www.authdog.com/docs/sdks/zig.md): Stdlib-only management client for userinfo and the REST API.

## Site

- [Docs overview](https://www.authdog.com/docs): Docs home. Start here for concepts, guides, and SDK indexes.
- [API reference](https://www.authdog.com/docs/api.md): HTTP API reference for Authdog services.
- [Security](https://www.authdog.com/docs/security.md): Security model and hardening guidance.
- [Python SDK](https://www.authdog.com/docs/sdks/python.md): authdog 0.1.1 on PyPI: management client and userinfo.
- [Zig SDK](https://www.authdog.com/docs/sdks/zig.md): authdog 0.1.0: stdlib-only management client and userinfo.
- [Web SDK](https://www.authdog.com/product/web-sdk): Framework SDK overview and package index.
- [Pricing](https://www.authdog.com/pricing): Plans and usage.
- [Console](https://console.authdog.com): Manage tenants, projects, environments, and users.

## Optional

- [Changelog](https://www.authdog.com/changelog): Product release notes.
- [GitHub](https://github.com/authdog): Open-source SDKs and tooling.
- [Status](https://status.authdog.com): Service availability.
- [Sitemap](https://www.authdog.com/sitemap.xml): Full URL index for crawlers.