Tokens, scopes, RBAC, policies, and audit trails for multi-agent systems. Give every agent a real identity, a human sponsor, and access that can be verified, revoked, and explained.
stripe:orders:readgrantedstripe:orders:approvedeniedbudget.maxCostPerDay$5,000Start with issuance and verification. Scale to budgets, policies, audit, and global revocation.
Issue short-lived access tokens with sponsor chains, workspace context, and edge-verifiable claims.
Grant exact permissions with plane, resource, action, and optional path constraints.
Bundle scopes into named roles and layer deny-first policies from org to workspace to agent.
Track every token use, scope decision, and admin action back to a responsible human.
Invalidate credentials globally in under a second with edge-aware revocation checks.
Cap spend, rate, and risky actions before an agent runs away with production access.
Use the same identity plane across local coding agents, cloud workers, approval bots, and internal platforms.
Create identities, issue scoped tokens, verify claims, and enforce permissions from the same control plane.
import { RelayAuthClient } from "@agent-relay/auth";
const auth = new RelayAuthClient({
apiKey: process.env.RELAYAUTH_API_KEY,
});
const identity = await auth.identities.create({
name: "billing-bot",
orgId: "org_acme",
workspaceId: "ws_prod",
sponsorId: "user_jane",
});
const token = await auth.tokens.issue({
identityId: identity.id,
scopes: [
"stripe:orders:read",
"relaycast:channel:write:#billing",
],
ttl: "1h",
});
const claims = await auth.tokens.verify(token.accessToken);
await auth.authorize({
token: token.accessToken,
scope: "stripe:orders:read",
});Ship authorization for agents without building an identity platform from scratch.
No auth service to stitch together, no token broker to run, no callback validator to babysit.
Create an identity, issue a token, and protect a route in minutes instead of designing an IAM stack.
Use the same token model across Workers, Node, Python services, edge middleware, and MCP tools.
Create the agent, mint the token, and publish verification keys for every service that needs to trust it.
curl -X POST https://api.relayauth.dev/v1/identities \
-H "content-type: application/json" \
-d '{
"name": "billing-bot",
"org_id": "org_acme",
"workspace_id": "ws_prod",
"sponsor_id": "user_jane"
}'curl -X POST https://api.relayauth.dev/v1/tokens \
-H "content-type: application/json" \
-d '{
"identity_id": "agent_8x2k",
"scopes": ["stripe:orders:read", "relaycast:channel:write:#billing"],
"ttl": "1h"
}'curl https://api.relayauth.dev/.well-known/jwks.json
# Then validate locally and enforce:
# stripe:orders:readPowered by Agent Relay
One identity layer for Relaycast, files, cloud jobs, MCP servers, and the rest of your agent stack.