Customer identity
Sign-up customers finish
- Passkeys, one-time codes and federated sign-in
- Self-service Customer Dashboard
- B2B tenants with their own admins, SSO and SCIM
Identity provider · Customers · Workforce · AI agents
One identity provider for your customers, your workforce and your AI agents.
Sign-in, single sign-on, access, support and audit in one place — under separate rules for customers, employees and administrators that never mix. Built from the lessons of real identity breaches.
- No sign-up needed for the demo
- First 25,000 customers free
- Workforce users $2 / month
The WebFrolic administrator console. Explore it in the live demo ↗
The problem
Most identity stacks were built one floor at a time.
A sign-in product here, a separate workforce directory there, a ticketing tool on the side and a bridge for every integration. Each joint is another place for access to leak. WebFrolic is one foundation with separate doors.
What WebFrolic does
Five areas. One identity provider.
Start with the area you need today; the rest is already there when you need it. Prefer another view? Browse by product, by solution or take the interactive product tour.
Workforce identity
Access that follows the job
- SSO and SCIM for employee applications
- Joiner, mover and leaver automation
- Device inventory and seat licenses
AI agents
Agents with their own identity
- Service and machine users, never borrowed passwords
- Scoped tokens from the vault, never client secrets
- Connections to act for a consenting user
Access & governance
Least privilege you can prove
- Privileged access with step-up and expiry
- Resource discovery, requests and access reviews
- Custom authorization server with per-operation API keys
Operations
Support that cannot be talked around
- Customer support bound to assigned tickets
- IT service desk where approved requests execute
- Six dashboards for every kind of work
Everything else
Browse every capability
- Webhooks, vault and variables
- Rate limits, network rules and adaptive security
- Audit trail with user, session and device context
Built from breach lessons
Where breaches start — and what WebFrolic does differently.
We studied how well-known identity incidents actually happened. Most began at an everyday seam, not a dramatic exploit.
| Where it goes wrong | The usual approach | WebFrolic |
|---|---|---|
| The support desk | Agents hold standing access to every customer record in a separate tool. | Support is built in. Agents see a customer only with an open ticket assigned to them, and impersonate only where the category allows. How it works |
| Access requests | A ticket in one system, a manual change in another, and senior requests that skip approval. | Approved requests execute themselves; manual changes need a valid service ticket ID; the same workflow applies whoever asks. How it works |
| AI agents and integrations | A shared service account or a person’s API key, with every permission they have. | Agents get their own identity and short-lived tokens; secrets stay in the vault; you choose per operation what an API key may call. How it works |
| Multi-factor authentication | “Two methods” counted as two factors, even when both can be phished. | Session assurance is calculated from each method’s characteristics — factor type, phishing resistance, device binding. How it works |
| Privileged access | Standing admin rights and shared admin logins. | Privileged roles need step-up and approved networks, grants expire, and shared jobs run as service users. How it works |
| Account recovery | The ordinary password-reset path, open to whoever can answer a question. | Recovery is its own ceremony with its own methods and assurance, and support issues recovery codes instead of resetting credentials. How it works |
Read the security white paper: Only as Secure as the Weakest Link →
See the product
Real screens, not mock-ups.
Six dashboards share one sign-in: Customer, Employee, Administrator, Customer Support, IT Service Desk and Tenant Administrator.
Try it yourself. Explore the dashboards and features on the live demo — no sign-up required.
Open demo.webfrolic.comSee the model at work
Follow the identity decision — not just the login.
Pick a situation to see which identities, controls and records are involved.
Scenario 01
An agent books a meeting in a third-party app — as the customer.
A support agent built on an LLM needs to create a calendar event in the customer’s own third-party account. It should use the customer’s consent, not a shared admin key, and never hold the customer’s refresh token.
What you will see: a machine user, a Connection with stored consent, a short-lived access token, network rules and an audit record naming the agent and the customer.
01The customer consents onceThe customer grants consent to the third-party app through a Connection; WebFrolic stores and refreshes the tokens.
02The agent asks for a tokenThe agent, running as a machine or service user assigned to the Connection, requests an access token for that customer from an approved network.
03The action is attributableThe agent receives only a short-lived access token; the refresh token never leaves WebFrolic, and the request is recorded.
Scenario 02
One person. A different level of responsibility.
A customer joins the company as an employee. Their identity has to move to the employee persona, with workforce rules, rather than leaving elevated access on a customer account.
What you will see: persona assignment, employee-only authenticators and applications, network and session rules, and the audit trail.
01Classify the personCustomer is the default persona; employee status comes from an employee domain, the employee group or configured creation.
02Apply workforce rulesEmployee authenticators, applications, roles, groups, profile attributes, network rules and the Employee Dashboard apply.
03Keep the recordAudit records include user, session and device context, so the change can be reconstructed later.
Scenario 03
Let each business customer run its own tenant.
A B2B customer wants to manage its own members and connect its own identity provider, while you keep control of platform-wide policy.
What you will see: tenant roles, members and groups, tenant SSO and SCIM, and tenant-level network and assurance rules.
01Create the tenantTenant-scoped roles decide what a tenant administrator can manage.
02Hand over the keysIn the Tenant Administrator Dashboard, they manage members, groups, domains, SAML or OIDC sign-in and SCIM.
03Apply tenant controlsNetwork filters and assurance requirements can be set for the tenant’s members.
Scenario 04
Help the real owner back in — and nobody else.
Recovery is where many account takeovers happen. WebFrolic treats it as its own ceremony and limits what support staff can do.
What you will see: recovery-only methods, ticket-bound support access, recovery codes instead of credential resets, and post-recovery safeguards.
01A dedicated recovery pathOnly methods allowed for recovery can be used, and recovery can require its own assurance level.
02Support helps, but cannot take overAgents see the customer only with an assigned, open ticket, and issue a recovery code instead of replacing credentials.
03Safeguards afterwardsOptions include removing old credentials, a post-recovery lock period and revoking the user’s API keys.
Pricing
Pay for what you use. Start for free.
Usage-based pricing, per unit per month, with no forced bundles.
Customer identity
25,000 customers free
$0.001per monthly active customer after the first 25,000, every month.
Estimate your cost ↗Workforce identity
Workforce users
$2per workforce user per month, with SSO, MFA, lifecycle, access governance and the IT service desk available.
Estimate your cost ↗Startups and non-profits
A fair start
$0 in year onefor eligible startups through the equity-backed startup partnership; 50% off for non-profits and education.
See the programmes ↗Depth you can check
Breadth that is documented, not just listed.
11sign-in methods, from passkeys to federated SAML and OIDC
6application types, including client credentials for machines
6dashboards for customers, staff, admins, support and tenants
4identity types: regular, service, machine and system
80documented API endpoints, with a Postman collection
OIDCOAuth 2.1 · PKCE requiredSAML 2.0SCIM 2.0WebAuthn · FIDO Metadata ServiceWebhooksOpen-source authorization server
Check our work
Evidence over adjectives.
We don’t publish invented customer logos or certifications we do not hold. Here is what you can inspect for yourself — and developers can start from the developer overview, the build checklist or the community.
Live demo
Try every dashboard
Explore the product on demo.webfrolic.com without signing up.
Design
Read why it is built this way
The security white paper by founder Sandeep Dhankar explains the breach patterns behind each design decision.
Fit
Compare honestly
The comparison matrix shows where WebFrolic stands out and where a specialist may fit better, with sources.
Common questions
Start with the details that matter.
What is WebFrolic?
An identity provider for your customers, your workforce and your AI agents. It covers sign-up and sign-in, single sign-on, provisioning, authorization, privileged access, access requests and reviews, customer support and IT service desks, and audit — with separate rules for customers, employees and administrators.
Can I try it without signing up?
Yes. The live demo at demo.webfrolic.com lets you explore the dashboards and features without creating an account.
Does WebFrolic support AI agents?
Yes. Agents run as service or machine users, get scoped access tokens from OAuth2 secrets in the vault, and can act for a consenting user through Connections. Client secrets and refresh tokens never leave the identity provider. For your own APIs, the custom authorization server lets you choose, operation by operation, what agents may call with an API key.
Which identity standards are supported?
OpenID Connect and OAuth 2.1 (PKCE is required for authorization-code flows), SAML 2.0, SCIM 2.0 and WebAuthn/FIDO2. Applications can use six types, and people can sign in with eleven methods, including passkeys and security keys.
How much does it cost?
You pay for what you use, per unit per month. The first 25,000 monthly active customers are free, workforce users are $2 each, and early-stage startups can use WebFrolic for their first year with no cash through the startup partnership. Model your own estimate in the pricing calculator.
Can we self-host?
The authorization server for your own APIs is available as open-source binaries you can run yourself, or hosted by WebFrolic. Talk to us about deployment options for the identity provider.
How should we evaluate security claims?
Read the security white paper, try the demo, then ask us to walk through the exact policy and recovery paths you need. We do not publish invented customer results or certifications we do not hold.
Get started
See it for yourself, then bring us your hardest identity problem.
Explore the live demo without signing up, estimate your cost in a minute, or book a walkthrough of the policy, integration and recovery paths you need.