Identity infrastructure built for
autonomous agents & teams
Stand up production-grade authentication, enterprise SSO, SCIM 2.0 directory sync, passkeys, and tamper-evident audit logs in a single tool call. Deterministic, scriptable, and completely headless.
Connect to https://dev.ulexid.com/mcp and set up Ulexid CIAM for this web app. Give me the approval link to sign in and authorize you.
npx @ulex/mcp-server
// 2. Bootstrap app, organization, SSO connection & admin credentials in 1 tool call
{
"name": "ulex_bootstrap_app",
"arguments": {
"application_name": "Acme Cloud",
"organization_name": "Acme Corp",
"organization_domain": "acme.com",
"connection_strategy": "okta_sso",
"admin_email": "admin@acme.com"
}
}
npm install -g @ulex/cli
# Authenticate with your tenant API key
ulex auth login --api-key "ulk_live_..."
# Run 60-second quickstart wizard
ulex quickstart --name "Acme App" --domain "acme.com"
# Headless simulated login returning real JWT access tokens
ulex login simulate --email "admin@acme.com"
curl -sS https://dev.ulexid.com/status | jq
# Inspect OIDC discovery document
curl -sS https://dev.ulexid.com/.well-known/openid-configuration
# Query the live JWKS signing key set
curl -sS https://dev.ulexid.com/.well-known/jwks.json
Built for agents, robust enough for enterprise
Everything an autonomous coding agent needs to build, test, and ship complete B2B SaaS authentication without blockers.
Customer Identity & Access Management
Drop-in modern authentication for web applications and SaaS (Auth0, Clerk & AWS Cognito parity). Passkeys, passwordless 6-digit email OTP, branded social logins, and B2B corporate SSO. Scoped token management for users, third-party apps, and background agents with customizable TTLs (60s–24h).
- ✓ Passkeys (FIDO2 WebAuthn) & 6-digit email OTP
- ✓ Branded social logins (Google, GitHub, Microsoft, Apple)
- ✓ B2B enterprise SSO federation (Okta, Entra, Google)
- ✓ Granular user token provisioning, scoping & revocation
- ✓ Zero seat licensing fees — unlimited customers
Workforce Identity & Access Management
Enterprise identity control for internal employees and corporate organizations (Microsoft Entra ID & WorkOS parity). Full SAML 2.0 IdP & SP, real-time SCIM 2.0 automated directory syncing, verified corporate domains, employee PATs, and the Employee App Launchpad.
- ✓ Full SAML 2.0 Identity Provider (IdP) & Service Provider
- ✓ Inbound & Outbound SCIM 2.0 directory lifecycle sync
- ✓ Employee Personal Access Tokens (PATs) & service keys
- ✓ Automated corporate domain DNS challenge verification
- ✓ Centralized Employee App Launchpad at /app/launchpad
Agent Identity & Access Management
Built directly into both CIAM and WIAM to govern autonomous AI coding agents and background workloads. Zero-touch RFC 8628 developer consent, 90+ MCP tools, RFC 8693 token exchange for service delegation, and attenuated runtime credentials.
- ✓ Zero-touch RFC 8628 consent deep links (/activate)
- ✓ RFC 8693 Token Exchange for multi-agent delegation
- ✓ Attenuated runtime keys with caller scope subset checks
- ✓ Custom short-lived TTLs (60s–86400s) & family revocation
- ✓ Complete deterministic headless simulation (no CAPTCHAs)
Headless & Deterministic
No browser automation, no CAPTCHAs, and no phone SMS. Run real identity flows headlessly in end-to-end tests with real JWT tokens and deterministic identifiers.
Enterprise Federation
OIDC / OAuth 2.1 with PKCE S256 and SAML 2.0 Service Provider. Seamlessly federate with Google Workspace, Microsoft Entra ID, and Okta with Just-In-Time (JIT) provisioning.
SCIM 2.0 Directory Sync
Inbound and outbound SCIM 2.0 lifecycle management. Synchronize users, groups, and memberships in real time with enterprise corporate directories.
Passkeys & Strong Auth
Hardware-backed WebAuthn FIDO2 passkeys, TOTP authenticator factors, and rotating refresh token families with replay detection and automated family revocation.
Cryptographic Audit Chain
Immutable, append-only audit trail chained by SHA-256 hashes. Tamper detection built into the control plane with automatic pseudonymization for HIPAA and SOC 2 compliance.
Real-Time Webhook Engine
34 distinct security and lifecycle event types. Verified against raw payloads using HMAC-SHA256 signatures with 5-minute replay guard and automated SSRF egress blocking.
Pure usage pricing. Zero seat tax.
Only pay for what you store and what you request. No per-seat penalties, no enterprise SSO upcharges, and no surprise tier traps.
How AI agents build identity with Ulexid
No cloud credentials to copy-paste. No CAPTCHAs. Your agent requests authorization, and you approve in one click.
Prompt Your Agent
Tell your coding assistant (Cursor, Claude Code, Windsurf, or Antigravity): "Connect to https://dev.ulexid.com/mcp and implement Ulexid auth."
Agent Generates Deep Link
The agent calls ulex_connect_agent and prints:
https://dev.ulexid.com/activate?code=ABCD-EFGH
One-Click Developer Consent
You click the link, sign in (or an isolated new tenant is auto-created), review requested scopes, and click Approve.
Agent Ships Complete Code
The agent claims scoped credentials, fetches Next.js/React recipes via ulex_get_integration_guide, and generates working code.
Active-Active multi-region resilience
Deployments operate active-active across AWS us-east-2 and us-west-2 with zero single point of failure.
Agents & Clients
MCP Agent Clients
Next.js Web Apps
CLI & Admin Users
Ulexid Control Plane
CloudFront Edge + DDoS Shield
Regional Lambda & DynamoDB
KMS Envelopes & Audit Sink
Powered by the Ulex engine
Enterprise IdPs
Okta · Microsoft Entra
Google Workspace
SCIM 2.0 Directories
Feature comparison across CIAM, WIAM & AIAM
How Ulexid compares to Auth0, Clerk, Microsoft Entra ID, and AWS Cognito.
| Feature | Ulexid | Auth0 / Okta | Clerk | Microsoft Entra ID | AWS Cognito |
|---|---|---|---|---|---|
| Agent-Native MCP Tools | ✓ Native (90+ Tools) | None | None | None | None |
| Zero-Touch Agent Onboarding (RFC 8628) | ✓ Full Native (/activate) | Manual Setup | Manual Setup | Manual Setup | Manual Setup |
| Customer IAM (Passkeys, 6-Digit OTP, Social) | ✓ Complete CIAM | ✓ Yes | ✓ Yes | Complex B2C | Custom Lambdas |
| User & Agent Scoped Token Management | ✓ Granular Scopes + TTLs | Basic Tokens | Session JWTs Only | ✓ Yes | Fixed 1h TTLs |
| Workforce SAML 2.0 IdP & SP | ✓ Both IdP & SP Included | SP only ($$$ for IdP) | SP only ($$$) | ✓ Yes | SP only (No IdP) |
| SCIM 2.0 Inbound & Outbound Sync | ✓ Inbound + Outbound | Enterprise Tier ($$$) | None | ✓ Yes | None |
| RFC 8693 Token Exchange for AI Delegation | ✓ Native OAuth Grant | Custom Microservices | None | Custom API | None |
| Active-Active Dual-Region Resilience | ✓ us-east-2 + us-west-2 | Enterprise Add-on | Single Region | Multi-Geo Add-on | Single Region |
| Tamper-Evident Hash-Chained Audit Logs | ✓ SHA-256 Hash Chain | Standard Log (Limit) | Audit Logs (Basic) | Log Analytics | CloudTrail Only |
| Enterprise SSO Tax | $0 (Included for all) | $150–$1,000+/mo | Custom Enterprise Plan | P1 / P2 License | Custom IAM SAML |
| Per-Seat License Fees | $0 (Pure Usage-Based) | $2 to $15 / seat | Per-user tiers | $6 to $15 / user / mo | $0 (MAU based) |
Inspect live services
Verified open standards and operational endpoints available directly on this deployment.