Introducing the next era of Duende IdentityServer.
Agent identity is a patchwork with competing registration mechanisms, non-standard trust boundaries, and vendor-specific token flows. As an SDK, Duende IdentityServer is uniquely positioned to stitch it all together with custom code where the specs leave gaps.
Agents identify themselves through evolving mechanisms — Dynamic Client Registration (RFC 7591), Client ID Metadata Documents (CIMD), or custom registration flows. IdentityServer supports what exists today and adapts as standards mature.
Agents find your endpoints, supported scopes, and token policies programmatically via Authorization Server Metadata (RFC 8414). Zero hardcoded URLs, fully machine-readable.
OAuth 2.0 flows issue scoped, time-limited tokens. Where agents cross trust boundaries or interact with third parties, IdentityServer's extensibility lets you implement the custom handshakes that no single spec covers yet.
Agent calls MCP servers or APIs with a scoped token. Your resource servers enforce the same policies regardless of whether the caller is human or machine.
The agentic landscape is fragmented with competing registration mechanisms, non-standard trust-boundary crossings, and vendor-specific token flows. Every deployment requires custom glue code. Other vendors give you a locked-down service. Duende gives you an SDK where that custom code lives naturally.
Why an SDK wins here:
• Patchwork of vendor tools, each needing custom integration
• Locked into a vendor's roadmap as specs evolve
• Separate auth systems for agents and humans
• No unified governance or audit trail
• Custom token logic for every trust-boundary crossing
• One SDK where all the glue code lives naturally
• Implement emerging specs (CIMD, ID-JAG) as they ship
• Single identity layer for all client types
• Unified audit trail with agents alongside humans
• Extensibility for the non-standard parts
The core agent authentication capabilities - registration, discovery, and token issuance - are available across IdentityServer editions. For production MCP servers on the public internet, where agents register dynamically and client counts are unbounded, you'll need a custom tier license with unlimited clients. Talk to our team to scope the right fit.
Tier | What's Included |
|---|---|
| Community Edition | RFC 7591 · 8414 (Runtime layer included) |
| Lite | + MCP Security (Full runtime stack) |
| Standard | + Agent Skills (Runtime + build-time) |
| Advanced | + FAPI 2.0 (Financial-grade profile) |
| Custom | Up to Unlimited (Everything, tailored) |
Agent identity is evolving fast. Duende gives you the SDK to keep up and implement what works today, adapt as standards mature, and own the custom logic that no vendor can provide out of the box.
