Your auth; per-user agents and metering.
Your users should not need a second login to get a personal agent. Your application asserts who the user is - with your existing auth - and each user gets their own durable agent instance, with memory, files, and spend attributed to them and to nobody else.
Three assertion paths, one trust model.
Your server mints short-lived session tokens carrying the user's identity. The strongest path: only trusted backends can assert who someone is.
The widget carries a signed identity assertion from your app, so an embedded agent knows its user without your frontend handling secrets.
Public keys serve anonymous or trial sessions - including ephemeral identities that exist for exactly one conversation.
A specialist per user
Identity is what keys the durable workspace: each verified user gets their own agent instance whose memory and files never mix with anyone else's.
Spend follows the person
Usage attributes per end user, with hard caps per user and per organization - enforced before a runaway session becomes a surprise bill.
For your own builders and operators: sign-in with Google or GitHub, TOTP and passkeys, and step-up auth on sensitive actions. SAML, OIDC, and SCIM against your identity provider are in early access - talk to us.