Hosted authentication for your users.
Scoped access for their AI clients.
Launch branded customer sign-in with Hosted Auth. When an AI client needs access, let the user approve one resource and explicit actions instead of sharing their application session. Operate both from India with documented data boundaries and DPDP-readiness controls.
No payment card during early access · Customer Identity available now · MCP Authorization in developer preview
Built on the standards every serious stack runs on
- OpenID ConnectDiscovery
- OAuthPKCE authorization
- WebAuthnPasskeys
- FIDO2Strong auth
- JWT · RS256Signed tokens
Available and planned identity methods
- GitHub
- SMS
Launch Hosted Auth in three steps.
Create a Test environment, configure an allowed callback, and connect the NamoID Auth URL to your application. Native Hosted Auth does not require you to register an OAuth client.
- 1
Configure your Test environment
Enable the sign-in methods you need, add your callback URL and web origin, then copy the NamoID Auth URL and key from Integration.
https://<test-host>/sign-in - 2
Start Hosted Auth
Use the SDK to create state and PKCE, then redirect the browser to the hosted sign-in page. NamoID returns a single-use hosted-auth code to your callback.
GET /sign-in - 3
Complete the callback
Verify state, exchange the code, and create your application session. Server integrations may use a Client Secret; public clients use their Client ID with PKCE.
POST /v1/auth/hosted/exchange
Authenticate the person. Authorize the AI client separately. Keep one operating model.
Customer Identity handles sign-in and user sessions. MCP Authorization gives an AI client its own resource, scopes, audience, expiry, and revocation boundary. Future Workforce Identity and Agent Access work is labelled separately below.
Customer Identity · available in early access
Hosted sign-in, social providers, passkeys, MFA, users, sessions, and audit for customer-facing applications.
Hosted login
A polished login on your own domain. Nothing to build.
Build with the API
Prefer headless? Run the whole flow from your backend.
Passkeys & MFA
Logins that shrug off phishing, on from day one.
Social login
Let people in with accounts they already have.
Workforce Identity · in design
A design-partner direction for employee lifecycle, assignments, and standards-based SSO—not a product you can deploy today.
MCP Authorization · developer preview
Let a user approve one resource and explicit actions, then give the AI client a short-lived token for that audience.
Agent Access · in design
A design-partner direction for governed connections to external providers without exposing credentials to agent code.
Test & Live environments
Keep experiments, credentials, users, and production policy inside explicit environment boundaries.
Audit & privacy
Scoped append-only security events and user-run processing-history exports.
Use the OIDC library your stack already runs.
Read discovery from the environment issuer, validate signed tokens with its public JWKS, and keep token verification in your application. NamoID packages can shorten integration work, but the protocol surface remains standard OAuth and OpenID Connect.
Works with standards-compliant OIDC libraries. Read the docs or open the API reference. Book a demo →
# Prefer OIDC? Use the environment issuer with any OIDC library$ curl https://acme-game-7f3a1c.sandbox.namoid.in/.well-known/openid-configuration { "issuer": "https://acme-game-7f3a1c.sandbox.namoid.in", "authorization_endpoint": "https://acme-game-7f3a1c.sandbox.namoid.in/oauth/authorize", "token_endpoint": "https://acme-game-7f3a1c.sandbox.namoid.in/v1/oauth/token", "jwks_uri": "https://acme-game-7f3a1c.sandbox.namoid.in/v1/oauth/jwks.json"}
Security claims you can inspect.
Identity is only worth what it protects. These aren’t roadmap promises. They’re how the service is built today.
Identity data is minimized
Security and audit flows prefer scoped identifiers over names, emails, credentials, or other personal data when the identifier is enough.
Encrypted at rest
Provider access and refresh tokens are sealed with AES-256-GCM, and never written to logs.
Asymmetric signing
Tokens are signed RS256. Only the public key is published via JWKS; the private key never leaves the service.
PKCE S256 for authorization code
Required for authorization-code clients, including first-party clients. There is no implicit or password grant.
Refresh token rotation
Every refresh issues a new token and revokes the old one. A replayed token kills the entire chain.
Append-only audit
Security-sensitive state changes produce scoped audit evidence rather than overwriting the history that investigators need.
- PKCE enforced
- RS256 · JWKS
- AES-256-GCM at rest
- DPDP-readiness controls
- GDPR-aligned privacy
- ISO 27001 · SOC 2 readiness
Primary identity workloads run in Mumbai. Boundaries included.
- Primary identity workloads in AWS Mumbai
- DPDP-readiness workflows and documented boundaries
- Subprocessors and transfer boundaries disclosed
Compliance should be something your team can operate.
India’s final DPDP framework is notified, with major substantive obligations phasing in by May 2027. That turns notice, consent, rights handling, security, and incident readiness into product work. You remain the Data Fiduciary; NamoID supplies identity controls and evidence that can support those responsibilities.
Consent becomes a product object
MCP resource grants preserve the resource and scopes a user approved, so delegated access can be inspected and revoked independently.
People can correct their profile
Hosted account flows support profile correction, processing-history export, and an account soft-deletion request without inventing a separate support workflow.
Security events keep their history
Security-sensitive lifecycle actions produce append-only audit events with tenant, project, and environment context.
Primary infrastructure in Mumbai
Primary production infrastructure runs in AWS Mumbai. Optional providers and subprocessors may process data elsewhere, and those boundaries are documented.
DPDP compliance still depends on your notices, purposes, policies, and operations. NamoID supplies the identity controls and evidence rather than a legal certificate.
The things teams ask before they switch.
What can we use today?
Customer Identity is available under early-access terms. MCP Authorization is a developer preview. Workforce Identity and Agent Access are design-partner product directions, not generally available features.
Is NamoID only for companies in India?
No. NamoID uses standards such as OAuth, OpenID Connect, SAML, WebAuthn, and JWKS. India is where the product has additional depth: DPDP-focused workflows, local operating context, and India deployment requirements.
Does NamoID guarantee DPDP compliance?
No product can make an organization compliant on its own. NamoID provides identity controls and evidence for consent, audit, privacy operations, minimization, and retention. Your organization remains responsible for its notices, purposes, policies, and legal obligations.
Do you have ISO 27001 or SOC 2 certification?
Not today. ISO 27001 and SOC 2 inform our control-readiness program, but NamoID does not currently claim ISO 27001 certification or a SOC 2 report. Completed assessments are listed on the Security page.
Can we migrate from another identity provider?
Usually. NamoID uses OAuth and OpenID Connect, so many applications can begin by changing issuer, client, redirect, and token-validation configuration. User migration and session strategy depend on your current provider and should be reviewed before production cutover.
Do we have to use Hosted Auth?
Hosted Auth is the fastest supported path. API and SDK integrations offer more control where needed. The right choice depends on how much authentication UI and security behavior your team wants to own.
How do MCP Authorization and Agent Access differ?
MCP Authorization protects a resource your product exposes to AI clients. Agent Access is the planned inverse: allowing a named agent to use a human-authorized external account through short-lived, policy-bound access without receiving the provider credential.
Run your first customer sign-in in Test. Keep AI access separate.
Configure a callback and complete Hosted Auth first. If your product exposes an MCP server, talk with us about resource, scope, audience, consent, and expiry boundaries.
Customer Identity early access · MCP Authorization developer preview · Workforce Identity and Agent Access in design.