Build governed identity anddelegated access intoyour applications.

Explore how identity, bounded authority, policy decisions, continuous trust and evidence connect across existing enterprise systems. Choose the integration path that fits your architecture.

Explore quickstarts

View documentation

What is Zoiko ID?

Zoiko iD is programmable identity infrastructure for people, organizations, services, machines and AI agents. Its architecture connects identity, authority and evidence so integrating systems can distinguish:

Who is acting — verified principal, service account, or AI agent

What scope has been delegated — bounded, time-limited mandate

What policy governs an action — organization rules and risk evaluation

What evidence explains the decision — immutable audit trail

Specific implemented interfaces and availability must be confirmed in the current documentation.

Identity

Verified actor with credentials. Who is making the request?

Authority

Bounded mandate with scope and time. What can they do?

Evidence

Immutable audit trail. Why was the decision made?

Policy

Continuous evaluation and revocation. Real-time trust.

Choose an integration goal

Identity & SSO

Integrate with your IdP (Okta, Azure AD). Verify actor identity. Layer delegated authority on top.

Quickstart

Delegated Authority

Build on-behalf-of access. Grant time-limited, scoped mandates. Revoke instantly when needed.

Quickstart

Machine & Agent

Issue credentials to services, AI agents, and non-human principals. Bind identity to actions.

Quickstart

Evidence & Events

Stream identity and authority events. Build custom audit, compliance and observability workflows.

Quickstart

How the trust layer works

Principal Identity

Actor verified with credential

Bounded Mandate

Scope, time, & purpose defined

Policy Evaluation

Context & risk assessment

Evidence Logged

Immutable audit trail

Allow / Deny Decision

Real-time access control

Continuous verification: At every request, the trust layer re-evaluates all signals. If identity expires, mandate changes, policy updates, or a risk signal is detected—the decision updates in real time. No perpetual “approved” state.

Overlay-first architecture

No rip-and-replace. Your IdP, applications, databases, and policy engines stay in place. Zoiko iD layers on top.

Existing IdP stays

Okta, Azure AD, Keycloak, etc. Still handles authentication.

Policy engines stay

Your existing ABAC, RBAC systems. We add context.

Apps unchanged

No forced refactoring. Integrate via APIs & events.

Zoiko iD adds

Identity binding, authority, evidence. Optional, incremental integration.

Standards and protocols

Protocol / Standard	Integration Role	Status	Details
OAuth 2.0	Authentication layer integration	AVAILABLE	Authorization Code, PKCE flows
OIDC	Identity federation	AVAILABLE	ID tokens, userinfo endpoint
SAML 2.0	Enterprise SSO	AVAILABLE	Assertions, metadata publishing
mTLS	Service-to-service identity	AVAILABLE	X.509 certificates, key pinning
JWT	Token format & verification	AVAILABLE	HS256, RS256, ES256 algorithms
SCIM 2.0	Identity provisioning	PLANNED	User/group sync
CloudEvents	Event streaming	AVAILABLE	Webhooks, async events
OpenTelemetry	Observability signals	PLANNED	Traces, metrics, logs

APIs and policy interfaces

Authentication & Federation

Issue credentials, verify identity, integrate with IdP. OAuth 2.0, OIDC, SAML, mTLS.

View API docs

Credentials & Verification

Create, revoke, and verify credentials. Manage certificate lifecycle. Check revocation status.

View API docs

Delegated Authority & Decision

Create mandates, check scope, evaluate policy. Bind identity to bounded authority.

View API docs

Service & Agent Identity

Enroll services, issue agent credentials. Manage non-human principals.

View API docs

Signals & Revocation

Stream trust signal changes, policy updates, and revocation events in real time.

View API docs

Evidence & Events

Query audit trail, export compliance evidence, subscribe to authorization events.

View API docs

Quickstarts

Get up and running in minutes. Task-based guides for common integration patterns.

Add SSO to your app

Integrate OAuth 2.0 / OIDC. 10 minutes for basic flow. Supports JavaScript, Python, Go, Java.

Start guide→

Issue an agent credential

Start guide→

Create a delegation mandate

Define scope, time, and purpose. Grant on-behalf-of access. 15 minutes.

Start guide→

Stream identity events

Subscribe to credential, mandate, and policy change events. Build custom workflows.

Start guide→

View all quickstarts

Events and webhooks

Subscribe to identity changes

When credentials are issued, revoked, or expire—or mandates change, policies update—Zoiko iD streams events to your webhook endpoint in real time.

Event Types

•credential.issued— New credential created
•credential.revoked— Credential withdrawn
•mandate.created— Delegation granted
•mandate.expired— Time boundary reached
•mandate.revoked— Delegator withdrew
•policy.updated— Organization rule changed
•decision.allowed— Action approved
•decision.denied— Action blocked

Signed delivery

HMAC-SHA256 signature. Verify webhook authenticity.

SDKs and toolchain

Official client libraries and tools. Type-safe, fully tested, actively maintained.

JavaScript/Node.js

NPM

Python

PyPI

Go

Go Modules

Java

Maven

Ruby

Gem

C#/.NET

NuGet

Docker

Compose

CLI Tool

Homebrew

Status: All SDKs actively maintained. Security patches published within 24 hours. Version compatibility tracked in supported versions guide.

Sandbox and evaluation

Gated environment

Sandbox access is by request. We provision isolated test environments for qualified organizations.

Start here

Talk to our team. We'll discuss your use case, set up a sandbox, and walk you through integration.

Request sandbox

What you get: Isolated tenant, test API keys, sandbox webhooks, example apps, and direct access to our integration team. No credit card required.

Security and privacy by design

Secure credential storage

Secrets never logged. HSM-backed. AES-256 encryption at rest. Encrypted in transit (TLS 1.3).

Secret rotation

Automatic key rotation policies. Manual rotation on-demand. Zero-downtime secret swaps.

Least privilege

Narrow service scopes. Tenant-bound object access. No cross-tenant data access.

Data isolation

Multi-tenant, single-tenant options. Audit logs never mix. Compliance-ready isolation.

Never paste secrets into public forms

Use API keys, environment variables, or secure vaults. Tokens sent to us are rotated immediately by our system.

Evidence and observability

Complete audit trail

Actor Identity

Principal, service, or AI agent that took the action

Mandate Status

Which delegation was referenced and its validity

Policy Version

Which rules were applied at decision time

Decision Trace

Allow, deny, or error—with reason and timestamp

Event Signature

Cryptographic proof. Cannot be altered or forged.

Export compliance

Pull audit evidence in SOC 2, ISO 27001, HIPAA formats. Ready for auditors and regulators.

Query and dashboard

Search audit trail by actor, resource, time range. Build custom compliance dashboards.

Stream events

Subscribe to all evidence events. Feed into SIEM, log aggregation, or custom analysis tools.

Failure modes and lifecycle

Every decision outcome. Every failure state. Every safe next step.

ALLOWED

Action approved. Request proceeds. Evidence logged.

DENIED

Action blocked by policy. Return 403 Forbidden. Log reason.

EXPIRED

Credential or mandate expired. Revoke immediately. Prompt re-auth.

REVOKED

Delegator or policy withdrew. Return error. Alert upstream system.

SOURCE UNAVAILABLE

Can't reach IdP or policy engine. Return 503. Implement fallback.

RATE LIMITED

Too many requests. Return 429. Implement backoff and retry.

TIMEOUT

Decision took too long. Return timeout error. Log context.

UNKNOWN

Can't determine outcome. Fail safely. Require manual review.

Frequently asked questions

Ready to build with Zoiko ID?

Whether you're building SSO, delegated access, AI agent identity, or compliance infrastructure—we're here to help. Choose your next step:

Start a quickstart

Read the Docs