Sign-in and credentials for people, agents, and services.
auth9 proves who is calling, whether that is a person, an agent, or a service, and leaves what they may do to each product. db9 accounts, anonymous starts, and API credentials run on auth9 today.
Check a token where it lands.
Services verify short-lived auth9 tokens against a published key set, without a call back to auth9 on every request. The Go verifier is open source.
# verify auth9-issued tokens in a Go service (Apache-2.0) $ go get github.com/db9-ai/auth9token-go # the verifier pins your issuer and audience, fetches the # published key set, and returns a typed reason on failure
Sign in. Issue. Verify.
auth9 authenticates. Each service keeps its own authorization.
Browser or CLI
People sign in in the browser, or from a CLI with device login, including SSO through a connected identity provider.
Credentials per caller
Agents and services get their own API keys and AK/SK pairs. Each is scoped, can expire, and can be revoked.
No account needed first
With db9, an agent can begin under an anonymous identity before anyone signs up. A person claims the account later.
Use sys9 identity in your service.
Registering your own service or OAuth client with auth9 is done with the sys9 team.