Humans
SSO, passkeys, and MFA out of the box. Sessions carry scopes, not roles — access expires with the task, not the quarter.
sg.sessions.create()
HUMANS
SERVICES
AGENTS
Grant exactly
enough.
One auth platform for people, services, and AI agents. Every credential is scoped, expiring, and on the record — issued in one call, verified at your edge.
npm i @scopegrant/node · 5-minute integration
scopegrant — zsh
$ sg grant --to agent:support-bot \
--scopes read:tickets,write:replies --ttl 24h
✓ grant g_7f2k9q issued · expires 2026-07-15T14:02Z
→ audit: scopegrant.com/audit/g_7f2k9q
$ sg verify g_7f2k9q --scope write:replies
✓ valid · identity agent:support-bot · 23h 58m left
$
EVERY IDENTITY
Machines are first-class
Sign-in for your team, workload identity for your services, scoped delegation for your agents — one grant model, one audit trail.
Services
Workload identity for CI jobs, cron, and microservices. Short-lived tokens replace long-lived secrets — nothing to leak, nothing to rotate.
sg grant --to svc:ci-runner
Agents
Delegate a slice of a user's access to an AI agent — scoped down, time-boxed, revocable mid-task. Every action attributed to the agent, not the user.
sg.grants.delegate()
VERIFY AT YOUR EDGE
The authorizer server runs next to your app
Deploy sg-authorizer as a sidecar or gateway. It verifies grants locally in under a millisecond — no round-trip to us, and it keeps working if we're down.
- ✓Signed grants verified offline with cached keys
- ✓Revocations pushed in under a second
- ✓Single static binary · Docker · Helm chart
middleware.js
NODE
import { authorize } from "@scopegrant/node";
app.post("/deploy",
authorize("deploy:prod"), // 0.4ms, local
(req, res) => {
// req.identity → "svc:ci-runner"
// req.grant.expiresAt, req.grant.id
});
PRICING
Priced per identity, not per seat
MOST TEAMS
SCALE
$99/mo + usage
Unlimited identitiesSelf-hosted authorizer90-day audit retentionAgent delegation
Start trial
Every identity, scoped.
Issue your first grant in five minutes. Free for the first thousand identities.
Authorizer server
sg-authorizer is a self-hosted verification server that validates grants at your edge. It caches signing keys and revocation state locally, so authorization decisions take under a millisecond and survive a ScopeGrant outage.
v2.4.1
linux/amd64 · arm64
static binary · 12 MB
Install & run
Run the authorizer as a sidecar next to each service, or as a shared gateway. The container needs one secret: an authorizer key scoped to your environment.
docker
$ docker run -p 7420:7420 \
-e SG_AUTHORIZER_KEY=$SG_KEY \
scopegrant/authorizer:2.4
✓ listening on :7420 · keys synced · env:prod
Configuration
All configuration is via environment variables. Defaults are production-safe.
VARIABLEDEFAULTDESCRIPTION
SG_AUTHORIZER_KEY
—
Required. Key issued via sg authorizer create-key.
SG_PORT
7420
HTTP listen port.
SG_KEY_REFRESH
60s
Signing-key cache refresh interval.
SG_REVOCATION_MODE
stream
stream (push, <1s) or poll.
SG_FAIL_MODE
closed
Behavior on unverifiable grants: closed denies, open allows with an ▲ AMBER audit entry.
Verify API
Your services call the authorizer over localhost. One endpoint answers the only question that matters: is this grant valid for this scope, right now?
POST
/v1/verify
REQUEST
{
"token": "sgt_eyJhb…",
"scope": "deploy:prod"
}
RESPONSE — 200
{
"valid": true,
"identity": "svc:ci-runner",
"grant_id": "g_7f2k9q",
"expires_at": "2026-07-15T14:02Z"
}
▲
Denials return 403 with a machine-readable reason (expired, revoked, scope_mismatch). Every decision — allow or deny — lands in the audit log with the grant id.
Health & metrics
METHODPATHPURPOSE
GET
/healthz
Liveness — process up.
GET
/readyz
Readiness — keys synced and revocation stream connected.
GET
/metrics
Prometheus — verify latency, cache age, deny reasons.