Introducing NamoID: Identity for Users and AI Clients
Shipping a consumer product means owning more than a login screen. Your team has to register clients, protect sessions, rotate tokens, record sensitive changes, and answer privacy requests without turning identity into a permanent integration project.
AI clients add a second problem. An MCP server needs to know who granted access, which resource the token is meant for, and which scopes the client actually received. Long-lived provider keys are the wrong primitive for that job.
NamoID brings those concerns into one product, while keeping the availability of each product area explicit.
Customer Identity is the starting point
Each environment exposes an OpenID Connect issuer and discovery document. Your application registers a redirect URI, sends the browser to Hosted Auth, exchanges the returned authorization code on its backend, and validates signed tokens with the issuer's public JWKS.
Customer Identity currently includes:
- Hosted sign-in and sign-up for web applications
- Authorization code with PKCE S256 for public clients
- Passkeys, TOTP MFA, email OTP, and selected social providers
- Refresh-token rotation and environment-scoped session controls
- Append-only security events for sensitive lifecycle actions
Customer Identity is available under early-access terms. Selected India verification and delivery adapters, including DigiLocker and Aadhaar-related flows, have separate rollout, approval, and provider-readiness requirements.
Authorization for MCP resources
MCP Authorization is a developer preview for teams exposing tools or data to AI clients. It builds on OAuth discovery, resource indicators, audience-bound access tokens, scopes, consent, and RFC 9207 issuer identification. The generated MCP metadata is designed to be hosted alongside the customer's own MCP resource.
Broader Agent Access — where a named agent acts through a human-authorized external account without receiving the underlying provider credential — remains a design-partner direction rather than a generally available feature.
India-ready, with boundaries you can evaluate
NamoID's primary production infrastructure runs in AWS Mumbai. Optional providers and subprocessors may process data elsewhere, and those boundaries matter when a team evaluates its own sector and cross-border obligations.
The product supports DPDP-readiness work through explicit consent records, privacy-conscious audit evidence, minimisation, retention controls, and user-run processing-history exports. These controls help a Data Fiduciary operate its privacy program; they do not make an organisation compliant on their own.
What's next
This blog is where we'll surface release notes, deep dives on the provider integrations, and the occasional "here's the bug that taught us X." Subscribe to the RSS feed so you don't miss them. Update, 14 July 2026: Customer Identity is available under early-access terms, and MCP Authorization is available as a developer preview. Create your account in the NamoID Console to evaluate the current product surface.
Ready to try it? Sign up for NamoID, read the launch announcement, or say hello at hello@namoid.in.