Own identity
Service and machine users
Agents act as a service user that named people assume, or as a machine user with client credentials or user consent.
Solutions / AI agents
Identity for AI Agents
AI agents need access to your APIs and to third-party APIs, sometimes for themselves and sometimes on a user’s behalf. WebFrolic gives them their own identity, scoped tokens instead of secrets, and an audit trail that names both the agent and the person behind it.
Available now in WebFrolic.
Why it matters
Most agents today run on a borrowed password or someone’s API key.
That is the shared-account problem at machine speed: broad access, no owner of record, and no way to tell the agent’s actions from the person’s. Agents need the same identity discipline as people, plus credentials they cannot leak.
Tokens, not secrets
Vault and Connections
Agents receive short-lived, scoped access tokens. Client secrets and refresh tokens never leave WebFrolic.
Bounded and traceable
Permissions, networks and audit
Per-permission API-key support, network firewall rules and recorded token requests keep each agent inside its lane.
The building blocks
Everything an agent needs, already in the identity provider.
Agentic AI
OAuth2 Secrets in Vault
Assign a third-party OAuth2 secret with selected scopes and an expiry; the agent gets an access token, never the secret.
Explore ↗Agentic AI
Connections
Users consent once; assigned agents request a refreshed access token to act on their behalf.
Explore ↗Identity types
Service and machine users
Give each agent its own accountable identity instead of a person’s credentials.
Explore ↗Authorization
Custom authorization server
Extend WebFrolic’s permission model to your own APIs, self-hosted or WebFrolic-hosted, and decide per operation which actions agents may call with an API key.
Explore ↗Security
Network rules
Limit where tokens and keys can be used from, per connection, secret, role or key.
Explore ↗Evidence
Audit and attribution
Record the agent and the person it acts for, so automated actions stay reviewable.
Explore ↗In the console
Set it up in four steps.
Menu names match the WebFrolic console. The setup guide has the detail.
Give the agent an identity
Create a service user or register an OAuth2 application (machine user) for each agent, with only the roles it needs.
Store third-party credentials
Put third-party client credentials in Vault → OAuth2 Secret, or configure a Connection for on-behalf access.
Assign scopes and limits
Assign the secret or connection to the agent’s identity with a subset of scopes, an expiry and network rules.
Review what it did
Check token requests and actions in the audit trail, attributed to the agent and the person behind it.
Before rollout
Questions worth answering.
Settle these first and the rollout is mostly configuration.
- List every agent and the APIs it calls, for itself or for a user.
- Remove client secrets and personal API keys from agent configuration.
- Decide which actions an agent may take without a person in the loop.
- Restrict token retrieval to the networks agents run in.
- Make sure you can revoke one agent without affecting others.
Related capabilities
Explore what connects to this.
These capabilities are usually configured together.
Evaluate with your scenario
Start with a concrete workflow.
Share the identities, resource boundary and decision you want to test. The walkthrough can focus on the relevant behavior rather than a generic feature tour.