Developer platform

REST, OAuth/OIDC, webhooks, sandbox, SDKs and MCP — one command layer.

From account to first verification in under ten minutes. AI agents connect through MCP and get exactly the tools, scopes and approvals your policy allows.

Read the quickstart API reference

# 1. create a verification session (sandbox)
POST /api/v1/verification-sessions
Authorization: Bearer ap_sandbox_…
Idempotency-Key: 9c0e…

{"subject": {"external_id": "TEST_IDENTITY_VERIFIED"},
 "checks": ["document", "face", "liveness"],
 "required_assurance": 3}

# 2. webhook
{"type": "verification.completed",
 "data": {"status": "verified", "assurance": 3,
          "checks": {"document": "pass", "mrz": "pass",
                     "face": "pass", "liveness": "pass"}}}

# 3. or let an agent do it
MCP tools/call authpermit_identity_verify {subject: "…"}

Projects & environments

Sandbox and production credentials per project. Deterministic test subjects. No PII in the sandbox.

Scopes that mean something

identity:verify, credential:issue, biometric:verify … the same vocabulary for API keys, OAuth tokens, roles and MCP tools.

Signed webhooks + replay

HMAC signatures, delivery log, retries and one-click replay from the portal.

Purpose-bound tokens

A token for “verify degree for employment, 7 days” instead of “access to John”.

MCP with guardrails

Read tools are safe; action tools need scopes; dangerous tools need approval. Tasks for long-running work.

Usage metering

Every operation produces a usage record — transparent bills and hierarchical rate limits.