एKRUTRIM EKAMAgent-identity control plane
Invite-only · v1

One identity for every principal — human or agent.

Krutrim Ekam is the agent-identity & delegation control plane. It issues short-lived, audience-bound, delegated tokens your gateway verifies offline — and bills the human owner.

Sign in with Google Open console Discovery

How it works

1

Provision

Owner mints an agent from a blueprint

2

Broker

Short-lived, scoped, delegated token

3

Verify

Gateway verifies offline via JWKS

4

Meter & bill

Map agent → budget → bill owner

5

Revoke

Kill-switch stops it in seconds

Key features

First-class agent identity

agt_… — owned, blueprinted, revocable. Not an API key.

Token broker

Audience-bound (RFC 8707), scoped, delegated via the act chain (RFC 8693).

Offline verification

ES256 JWT + JWKS — the gateway never calls Ekam on the hot path.

Kill-switch

Revoke an agent or token; introspection (RFC 7662) reflects it in seconds.

Human SSO + IGA

Google OIDC → type:human, with request → approve → grant.

Multi-tenant + cross-app

Tenant / entity model, plus ID-JAG cross-app delegation.

For developers

Discovery

Principals

  • Agents — POST /oauth/token brokers a scoped, delegated token.
  • Humans — Sign in with Google → type:human token.
  • Governance — /v1/access-requests; /v1/agents/:id/revoke.