Overview
Private Beta
Agent Identity is available as a Private Beta product, and the information contained in this document is subject to change. You acknowledge and agree that your use of Agent Identity is subject to the terms of the Services in Private Beta. Some features are not yet implemented and others may change before the product is declared as Generally Available. Private Beta products are not covered by the Twilio Support Terms or Twilio Service Level Agreement.
Warning
Agent Identity is not a HIPAA Eligible Service or PCI compliant and should not be enabled in workflows subject to HIPAA or PCI.
Agent Identity turns your application into an OAuth 2.1 and OpenID Connect compliant authorization server. Your users can grant an AI agent scoped, revocable access to their account, and you can require out-of-band human-in-the-loop approval for sensitive actions over a Twilio channel such as SMS or RCS before the agent proceeds.
- Issue standards-based access tokens to AI agents that act on behalf of your users, so your APIs can authorize agent requests with standard JWT validation.
- Keep your current authentication system — you identify the logged-in user, and Agent Identity handles the OAuth flow and consent management.
- Serve users a consent screen from your own domain, giving them the ability to grant fine-grained access to an agent.
- Track and revoke agent access — see which agents each user has authorized and what they can do, and revoke that access at any time.
- Require human approval for high-risk actions using Client-Initiated Backchannel Authentication (CIBA), delivered over Twilio channels.
- Securely authenticate agents using the latest Model Context Protocol (MCP) standard.
At a high level, an agent gets access in five steps:
- An agent redirects the user to your authorization endpoint to start an OAuth flow.
- If the user isn't already signed in, Agent Identity redirects them into your authentication system through the Trusted Auth Token flow. Your system authenticates the user and redirects them back to Agent Identity.
- Agent Identity shows the user a consent screen describing who the agent is and what access it is requesting.
- When the user approves, Agent Identity returns an authorization code to the agent.
- The agent exchanges the code for an access token and uses that token to call your APIs.
To understand each step in detail, see How Agent Identity works.
- New to the product? Read How Agent Identity works.
- Ready to build? Start with Set up Agent Identity.
- Integrating your login system? See Issue Trusted Auth Tokens.
- Adding permissions? See Authorize agents with scopes and Rich Authorization Requests.
- Adding human approval? See Require human approval with CIBA.