Open source · Self-hosted
Give AI agents access, not the keys
QAuth is the sign-in and access server for your apps and the AI agents working in them. An agent gets only what a person approved, risky actions need a fresh yes, and every step is on record. You run it on your own servers.
Research Assistant
wants to act for you in Acme Docs
- Read documents in Acme DocsAllowed
- Create and edit draftsAllowed
- Delete filesAsks you first, every time
- Open source, Apache 2.0
- Runs on your own servers
- Headless: your screens, our engine
- Sends no data to us
- Built on OAuth 2.1 and OpenID Connect
The problem
Agents need access. The usual ways weren't built for them.
An AI agent that books meetings, answers tickets or edits documents has to sign in somewhere. The usual shortcuts leave you exposed.
How it works
Access a person approved, and nothing more
QAuth sits between your users, their AI agents and your apps. It decides what each agent may do, for how long, and keeps the record.
- Personapproves
- QAuthissues a limited pass
- AI agentuses only that pass
- Your appchecks it on every call
- 1
A person says yes
Your user sees which agent is asking and what it wants to do, then approves it, the same way they sign in today.
- 2
The agent gets a limited pass
QAuth gives the agent a short-lived pass that names both the agent and the person. It works for one service only, at the level you allow, from read-only up to full control.
- 3
Risky steps ask again
Before something dangerous, such as deleting data, QAuth can ask the person to confirm once more. The agent cannot give that approval itself.
- 4
Every action is on record
Each agent has its own audit trail, so you can always say which agent did what, for whom and why.
It works for any app or service, and with MCP, the open standard that AI tools such as Claude use to connect to apps.
For any project
As simple as a login form, or as advanced as you need
Most projects start with a plain sign-in. QAuth gives you exactly that, and nothing else gets in the way: AI agents, quantum-era seals and national IDs stay switched off until you want them.
Complete OAuth 2.1 and OpenID Connect
One sign-in server for people, services and agents
QAuth is a full OAuth 2.1 and OpenID Connect server: the open standards behind most modern “Sign in with…” buttons. Your apps connect with the libraries they already use, so you are never tied to one vendor's SDK.
Peoplesign in to your apps, with a password or an account they already have
Servicescall each other securely, with no person involved
AI agentsact for a person, within the limits that person approved
Sign out once, everywhere
When a session ends, each connected app that asks to hear about it is told, so nobody stays signed in by accident.
A separate space per customer
Each realm has its own users, apps and address, for multi-tenant products and multiple brands.
Different rules per environment
Development, staging and production get their own policies, so a test agent never reaches live data.
A portal for your developers
Teams register their apps and manage API keys themselves, without filing a ticket.
Post-quantum ready
Recorded today, read tomorrow
No quantum computer can read today's encrypted traffic yet, and attackers are not waiting for one. They record it now and keep it until they can. NIST, the US standards body, calls this "harvest now, decrypt later" and names it one of the main reasons to move now. Identity data is the worst thing to lose this way: a name, a birth date or an ID number is still valid twenty years from now.
On the day such a computer exists, the digital seals that prove who signed in can be forged too, and someone could sign in as any of your users. Moving an identity system takes years, which is why NIST phases today's seals out after 2030. QAuth already adds a second, quantum-era seal to every pass, so apps that check it can still tell a forged sign-in from a real one. For the data on the wire, turn on post-quantum encryption for the connection: current browsers and proxies already support it, and QAuth works behind them unchanged.
The technical detailsWhat the standards bodies say
National digital identity
Sign-in with the digital IDs people already carry
QAuth brings sign-in with government-issued digital identity. Sign-in with the EU Digital Identity Wallet under eIDAS 2.0 is built; Japan's My Number Card and the Turkish identity card are planned. Each one reaches your apps as an ordinary OpenID Connect sign-in, so your apps integrate once.
Who it's for
Built for teams putting agents to work
Compare
How QAuth compares
Where QAuth is ahead of the other products in the comparison, and where it is behind. Both lists are worked out from the same table, which gives a source for every cell.
Where QAuth is today
Ready for production, and free on your own servers.
QAuth is open source and ready for production today. It stays below version 1.0 only until the features planned for 1.0 are finished.
See what is free and what will be paid on the pricing page.
See what is finished and what comes next on the roadmap.
Questions
Frequently asked questions
Want QAuth without the servers?
We're planning QAuth Cloud, a paid, hosted version you don't have to run yourself. Leave your email and we'll tell you when early access opens.
Give your agents access, not the keys
Start with the open-source server today, or send this page to the developer who would set it up.