Integration guide

Get started in 5 minutes

Integration steps

Step 1: Sign up and create an account

Go to authentify.icoa.ai/signup and create your customer account. You'll get a sandbox API key.

Step 2: Create your first agent

In the Getting Started page, create an agent and specify:

Agent name: my-classifier
Allowed actions: READ, CLASSIFY
Entity scope: * (all)
Rate limit: 1000 req/min

Step 3: Request authorization

When your agent needs access, call the /v1/authorize endpoint:

curl -X POST https://nhxm3hlw4qcs53nnrkvalae5cy0piuew.lambda-url.us-east-2.on.aws/v1/authorize \
  -H "Content-Type: application/json" \
  -H "x-api-key: aut_sandbox_your_key" \
  -d '{
    "action": "READ",
    "entityId": "customer-123"
  }'

Step 4: Validate the response

Authentify returns:

{
  "authorized": true,
  "decision": "approved",
  "confidence": 85
}

If authorized=true, your agent can proceed. If false, deny the request.

Step 5: Log violations and monitor

If your agent attempts an action outside scope (DELETE when only READ authorized), log it and call /v1/audit-logs to view:

curl https://nhxm3hlw4qcs53nnrkvalae5cy0piuew.lambda-url.us-east-2.on.aws/v1/audit-logs?customer_id=YOUR_ID&days=7

Key concepts

API keys

Each agent has a unique API key. Keep it secret. If compromised, revoke it from the dashboard.

Scope enforcement

Authentify issues a token with scope (READ-only, for example). Your system must validate the token and enforce the scope. Authentify logs violations and auto-revokes on scope breach.

Audit logs

Every authorization request is immutably logged with timestamps, actor, action, result. Perfect for regulatory compliance.

Revocation

If an agent misbehaves or you suspect compromise, revoke it from the dashboard. All future requests are denied immediately.

Production checklist

✓

Create agent in sandbox environment first

✓

Test with real data

✓

Verify authorization logic in your system

✓

Set appropriate rate limits

✓

Monitor audit logs regularly

✓

Document scope boundaries for compliance

✓

Promote agent to production when ready

Troubleshooting

Getting "Invalid key" error?

Make sure you're using the agent's API key, not the customer key. Check it in the dashboard.

Scope violation detected?

Agent attempted action outside authorized scope. Check your enforcement logic and revoke if needed.

Rate limit exceeded?

Agent hit the per-minute authorization request limit. Increase in settings or optimize request frequency.

Still stuck?

Email hello@authentify.io.

SDKs (coming soon)

Python, Node.js, and Go SDKs will handle API calls for you.