Agent-native setup plane
Let maintenance agents request access without handling the dashboard.
Identity gives agents a documented path to discover resource services, open the required access request, mint an org-scoped API key, and exchange that key for short-lived OIDC JWTs.
Agent setup request
org=acme, service=agentier-dashboard
Discover
list_targetsFind requestable resource services and their published scopes.
Ask
request_service_accessCreate the auditable service-access approval row first.
Mint
request_api_keyIssue the setup key only after the access request is approved.
Exchange
/oauth/tokenTrade the setup key for 15-minute JWTs at runtime.
One setup credential, short runtime tokens.
API keys are the durable approval outcome for a specific org and authorized resource set. Resource services receive JWTs with one audience per token, so authorization remains local and explicit.
Approval creates org-scoped service access, not a bearer credential.
API keys stay at setup boundaries and can be revoked without changing resource services.
Short-lived JWTs carry aud, azp, org, scope, and service_request_id claims.
MCP tools expose the setup workflow.
Agents can use the same approval language humans see in the dashboard. Failed API-key requests include a corrective hint to call request_service_access first.
{
"mcpServers": {
"identity": {
"url": "https://identity.1above.ai/mcp",
"headers": {
"Authorization": "Bearer <user-or-bootstrap-token>"
}
}
}
}