LumoAuth Documentation
LumoAuth is an identity platform for traditional applications and autonomous AI agents. It implements the standard protocols — OAuth 2.0, OpenID Connect, SAML 2.0, SCIM 2.0, WebAuthn — and layers on fine-grained authorization (RBAC, ABAC, Zanzibar ReBAC), adaptive MFA, and first-class agent identity.
If you are new to identity protocols, start with Core Concepts. If you already know OAuth, pick a track below and skip ahead.
Base URL
All API endpoints are scoped to an organization: https://app.lumoauth.dev/orgs/{orgId}/api/v1/
EU region: https://eu.app.lumoauth.dev/...
Pick your track
Each track is an ordered reading path. Follow it top to bottom and you will have a working result — no guesswork about what to read next.
| You are… | Track |
|---|---|
| Adding login to a web or mobile app | Frontend / Mobile → |
| Protecting a backend API or service | Backend / Service → |
| Securing an AI agent or LLM tool call | AI Agents → |
| Configuring the org for enterprise customers | Admin / IT → |
| Doing a security or compliance review | Security & Compliance → |
Framework quickstarts
| React | Next.js | Vue |
| Angular | Node.js | Python |
| React Native | AI Agents | LangChain |
Platform capabilities
| Capability | What it does |
|---|---|
| AI Access Control | Verified agent identities, scoped capabilities, delegation, just-in-time approval |
| Ask API | Natural-language authorization calls for LLM reasoning loops |
| JIT Permissions | Human-in-the-loop approval for sensitive agent operations |
| Chain of Agency | Token exchange (RFC 8693) so agents can act on behalf of users with a verifiable audit trail |
| MCP Servers | Authorize Model Context Protocol tool calls |
| OAuth 2.0 & OIDC | Standard flows for web, mobile, CLI, and service-to-service |
| Enterprise SSO | SAML 2.0, OIDC federation, Active Directory / LDAP |
| SCIM 2.0 | Automated user and group provisioning |
| Authorization API | RBAC, ABAC, and Zanzibar-style ReBAC |
| Passkeys & WebAuthn | FIDO2 passwordless login |
| Adaptive MFA | Risk-based step-up authentication |
| Multi-Organization | Isolated tenants per customer organization |
Getting help
- Error codes — API Reference → Errors
- Issues or bugs — github.com/lumoauth
- SDK reference — SDKs & Libraries