TL;DR: Auth for GenAI is now available in Developer Preview. You can now secure your agentic app with Auth0. Get started today.
Auth for GenAI is now available in Developer Preview. With our latest product, you can add a critical component to Generative AI applications: identity for AI Agents. Auth for GenAI integrates with popular AI frameworks like LangChain, Llamaindex, Google GenKit, and AI SDK by Vercel, which have already unlocked opportunities for you to build and deploy AI-powered applications. Stay tuned for more tools, content, SDKs, and sample apps in collaboration with these frameworks. With Auth for GenAI, you can now better secure agentic apps and seamlessly integrate with the broader GenAI ecosystem. Start building now with our docs.
Key Features of Auth for GenAI
When authenticating with GenAI apps, AI agents need to authenticate users, interact with other apps on the user’s behalf, use asynchronous interactions, and consider user permissions when accessing data. We’ve designed Auth for GenAI so that you can confidently build secure agentic apps with these key features:
- User Authentication — Implement a tailor-made login experience for AI agents. This includes account linking of all accounts for the user profile and step-up authentication. This will fully integrate the Universal Login into your GenAI apps.
- Token Vault — Token Vault can securely connect AI agents to tools like Gmail and Slack using OAuth 2.0 for token management while also automatically handling token refreshes and exchanges.
- Async Authorization — Async Authorization enables AI agents to perform tasks while awaiting human approval, bolstering accuracy, flexibility, and security through protocols like CIBA and PAR.
- FGA for RAG — Auth0 Fine-Grained Authorization (FGA) for Retrieval-Augmented Generation (RAG) only allows users to access permissible resources by performing access control checks at the document level.
User Authentication: Authentication for GenAI
As you build apps using AI agents, you need a secure and seamless way to authenticate users into those apps to ensure a user is who they say they are. Auth for GenAI enables users to authenticate while allowing them to link multiple accounts and identities into a single, unified profile. This empowers users to leverage different AI-powered tools and services without friction, maintaining a consistent identity across multiple platforms.
Once a user has signed in, there may be parts of your platform you still want to safeguard with additional layers of security and access control. Sensitive resources are often safeguarded with step-up authentication. This involves invoking an additional authentication factor, where you have flagged it necessary to do so. By integrating these capabilities, Auth for GenAI enables AI apps to securely authenticate users while maintaining a balance between user convenience and robust security controls.
Token Vault: Call APIs on the User’s Behalf
Token Vault is used by AI agents to securely integrate with external tools like Gmail, Slack, and GitHub, or even a company’s own first-party API. Unlike typical web apps, agentic apps rely on dynamic actions and data-fetching based on natural language inputs. To secure this process, Auth for GenAI builds upon OAuth 2.0 and OpenID Connect-based methods for API calls.
For first-party APIs, you can use standard OAuth 2.0 flows (like the Authorization Code Flow) to get API tokens with user consent, while Auth0 takes care of access token refreshes when the API token expires. For third-party APIs, Auth0 facilitates API access via a Federated API token exchange, which provides a way to obtain an access token from an external identity provider while avoiding repeated user re-authentication. Auth0 does this while also using scoped access tokens to minimize security vulnerabilities. To learn more, read our latest blog on Tool Calling in AI Agents.
Async Authorization: Authorize AI Agents in the Background
Async Authorization enables AI agents to handle tasks in parallel while seamlessly integrating "human in the loop" processes to maintain accuracy, accountability, and trust. Rather than a user having to constantly monitor operations, which is neither realistic nor necessary, the AI agent continues executing other actions, enhancing both flexibility and productivity. AI agents require human oversight —not only as a safeguard against errors but as a mechanism to ensure ethical and responsible decision-making in critical workflows. This oversight reinforces trust in the system, as it allows humans to intervene in key moments, verifying the agent's actions align with user intent and expectations. By leveraging protocols like Client-Initiated Backchannel Authentication (CIBA) and Pushed Authorization Requests (PAR), you can implement secure, asynchronous approval workflows, offering users a seamless experience while adding a vital layer of oversight and security. To learn more about how this works, visit our docs.
FGA for RAG: Granting Fine-Grained Access to External Data
RAG lets large language models (LLMs) retrieve data from external sources in real time, powering frameworks like LangChain and LlamaIndex. While this is important to expand the powers of the LLM, the agent has to be sure the person has access to a requested resource, especially when discussing private or sensitive topics. You can now use Auth0 FGA in an RAG application to enforce document-level access controls, only allowing users access to data they’re permitted to see. This approach replaces broad Role-Based Access Control (RBAC) with precise, permission-based checks, essential for protecting sensitive data and supporting compliance requirements. To learn more about RAG and access control, visit our docs.
These requirements generally apply to companies of all sizes and industries, whether they’re building B2B, B2C, or internal apps.
- A B2B company, like a SaaS-based HR and payroll automation platform, can use Auth for GenAI to confirm its AI agents use RAG to feed their customers’ employees the correct and authorized documents when they need to locate specific files.
- A B2C app, like a personal finance management app, can use Auth for GenAI so its AI agents can interact with and call the APIs of other applications, like the end user’s banking and investment apps, to properly analyze and prepare a plan for a large purchase.
- A company is building an internal productivity tool with a GenAI agent that quickly queries and analyzes data across its CRM and data warehouse. Using Auth for GenAI, this productivity tool will securely enable its employees to only query the data they should have access to.
While these are just examples, the power of Auth GenAI can extend to retail, e-commerce, SaaS, finance, media, hospitality, healthcare, and more.
Get Started with Auth for GenAI Today
Sign up to access Auth for GenAI in Developer Preview today. You can also visit auth0.com/ai to access documentation, explore our SDKs for JavaScript and Python, and find recipes and examples to leverage.
If you are using JavaScript, you have the option of using framework-specific SDKs:
Next.js
npm install @auth0/nextjs-auth0
Node.js
npm install auth0
Fastify
npm i @auth0/auth0-fastify
If you are using Python, you can use:
Python Server SDK
pip install auth0-server-python
FastAPI SDK
pip install auth0-fastapi
Python API SDK
pip install auth0-api-python
FastAPI API SDK
pip install auth0-fastapi-api
Stay tuned for updates as we iterate and launch features and enhancements. If you want to explore how they fit your use case, reach out to our sales team anytime.
We look forward to seeing what you will build.
About the author
Shiven Ramji
President, Customer Identity Cloud
Shiv is an experienced product executive and builder obsessed with creating beautiful products. He is the President of Customer Identity at Okta, managing a $1B ARR business and overseeing the company’s product, data, security, and technology strategy and execution. Before Auth0 and Okta, Shiv was the SVP of Product at DigitalOcean, leading DigitalOcean’s products, pricing, and partnerships. Additionally, Shiv has held product leadership positions at global brands, including Amazon, NBCUniversal, LiveIntent, and The Nielsen Company. Shiv was the recipient of the 2023 Top Global CPO Award by the Products That Count community.
Beyond his current corporate focus, Shiv is deeply committed to fostering entrepreneurship and innovation, particularly in Africa. He is an active angel investor and startup advisor and also serves on the boards of Products That Count and Aiven.io.