IntegrAuth
Identity & Security for All
Humans, Machines, RPA bots & AI Agents
Expert services in IAM, API Security, AI Integrations, Agent Authentication, MCP Security & Fine-Grained Authorization for modern enterprises
You’ve simulated it — now do it for real
Practice everything the Academy teaches, for real: log in passwordless, mint and verify a live JWT, trip an actual rate limit, and X-ray the real HTTP & database reality behind every step — each one cross-linked back to the lesson that explains it.
Evaluating us? The Lab is also our engineering on display — passwordless WebAuthn, sessions hashed at rest, strict CSP & headers, real rate limiting. We build this for clients.
- Passwordless login
- Real JWTs
- Live rate limits
- Request X-ray
Our Services
Professional services and support for AI & agent security, IAM, API security, and software engineering
Deep dives: MCP Security · AI Agent Security · API Security
Free Security Tools
Free, no-login, spec-cited self-service tools — paste public data, get an instant graded report.
27 browser-based micro-tools built by our identity, API, and AI-agent security specialists — grade OAuth 2.1, OIDC, SAML, JWT, WebAuthn, and MCP configurations against the specs, RFC by RFC.
MCP Auth Scan
Grade a remote MCP server's OAuth 2.1 authorization (RFC 9728/8414/8707)
mcpauthscan.integrauth.comMCP Scopes
Score MCP tool over-privilege (OWASP MCP02)
mcpscopes.integrauth.comTool Poison Check
Scan MCP tool definitions for tool-poisoning indicators (OWASP MCP03)
toolpoisoncheck.integrauth.comA2A Scan
Grade an A2A Agent Card's declared auth schemes
a2ascan.integrauth.comAI Gateway Check
Grade a LiteLLM / AI-gateway config for hardening gaps
aigatewaycheck.integrauth.comWell-Known Scan
Map & grade a domain's OAuth/OIDC/MCP .well-known discovery surface
wellknownscan.integrauth.comJWKS Check
Grade a JWKS endpoint's key hygiene + verify a JWT
jwkscheck.integrauth.comOIDC Federation
Analyze CI/workload-identity federation trust (GitHub/GitLab → AWS/GCP/Azure)
oidcfed.integrauth.comIAM Trust Check
Grade an AWS IAM trust/resource policy for confused-deputy & wildcard risk
iamtrustcheck.integrauth.comDPoP Toolkit
Generate & validate DPoP proofs (RFC 9449)
dpop.integrauth.comToken Exchange
RFC 8693 token-exchange composer & delegation explainer
tokenexchange.integrauth.comClient Assertion Check
Build & lint an OAuth client-assertion JWT (RFC 7523)
clientassertcheck.integrauth.comID Token Check
Lint an OIDC ID token's semantics + flag access-token misuse
idtokencheck.integrauth.comConsent Check
Risk-rank a third-party OAuth app's requested scopes
consentcheck.integrauth.comRedirect Check
Diagnose OAuth redirect_uri mismatches & open-redirect risk
redirectcheck.integrauth.comLogout Check
Grade an OIDC issuer's logout/revocation posture
logoutcheck.integrauth.comDCR Check
Static-grade Dynamic Client Registration exposure from discovery metadata
dcrcheck.integrauth.comOpenID Federation Check
Validate an OpenID Federation entity statement / trust chain
oidfedcheck.integrauth.comSAML Scan
Grade SAML SP/IdP metadata security (cert/SHA-1/XSW)
samlscan.integrauth.comSAML Response Check
Grade a pasted SAML Response for XSW / assertion security
samlresponse.integrauth.comGateway JWT Lint
Lint an API-gateway JWT-validation policy (Kong / Azure APIM / Apigee)
gwjwtlint.integrauth.comGraphQL Check
Grade a GraphQL schema's security posture (paste-only)
graphqlcheck.integrauth.comCookie Check
Grade session-cookie & token-response hardening
cookiecheck.integrauth.comPasskey Check
Grade a WebAuthn relying-party config
passkeycheck.integrauth.comSSF Check
Validate a Shared Signals / CAEP transmitter config + SET
ssfcheck.integrauth.comSPIFFE Scan
Decode & inspect SPIFFE X.509 / JWT-SVIDs
spiffescan.integrauth.comCert Lint
Grade a pasted X.509 certificate's hygiene
certlint.integrauth.comEvery tool mirrors a check we run in real engagements —
if a report surfaces gaps, our consulting services can help you close them.
Our Products
In-house developed software solutions
built entirely with cutting-edge technology
Smartable
Education ERP with Smart Auto Timetabling
Automated timetable generation using Google OR-Tools constraint programming
Wrenchub
Modern Vehicle Service Center Management
Cloud-based workshop software for digital job cards, real-time tracking, and SMS notifications
oidcscan
Free OIDC & OAuth Security Scanner
SSL Labs for your Identity Provider — paste an issuer URL, get a spec-cited security grade with a shareable report
hallbook
Function-Hall Booking & Payment Ledger
Double-booking-proof calendar, advances & receipts, and revenue reports for function halls
waterflow
Water-Plant Delivery Routes & Ledger
Route deliveries, can-deposit tracking and monthly statements with UPI payment links for packaged-water plants
sunnahfast
Sunnah fasting reminders — the night before, 7 PM your time, Insha Allah
Warm reminder emails before Mondays/Thursdays, White Days, Ashura, Dhul Hijjah & Shawwal fasts — free forever, Insha Allah
We Also Build Websites
Modern, fast, secure websites for restaurants, hospitals, schools and more — each live demo below ships with a dozen-plus switchable designs. Pick a style you love and we'll make it yours.
Want a site like these? Contact us — we design, build, secure & host it end-to-end.
oidcscan
Free OIDC/OAuth security scanner — SSL Labs for your Identity Provider
Key Features
- Paste an issuer URL — instant security grade of its OIDC/OAuth configuration
- Checks across discovery, JWKS, endpoints, PKCE, token & algorithm hygiene
- Every finding cites the exact RFC / OpenID spec clause it comes from
- Immutable, shareable report permalinks — paste them in tickets and PRs
- Monitoring accounts: e-mail alerts when your IdP posture drifts
- SSRF-hardened scanner; works with any standards-compliant IdP
Technology Stack
Frontend
SvelteKit, TypeScript, TailwindCSS
Backend API
Cloudflare Workers, Hono.js, TypeScript
Database
Cloudflare D1 (SQLite at the edge)
Protection
Cloudflare Turnstile, per-IP rate limiting
Resend (OTP sign-in codes & alerts)
Scans are free and need no account — sign up only to monitor your IdP over time. Findings map to the same checks we run in IAM security engagements.
hallbook
Function-hall booking calendar, advances & payment ledger — Telugu-first
Key Features
- Slot calendar with database-enforced double-booking protection
- Holds with automatic expiry — tentative bookings free themselves up
- Advances & payments on an append-only ledger, GST-aware receipts
- Shareable receipt links for customers; SMS/email notifications
- Revenue, outstanding-balance and hot-date reports
- Complete English + Telugu interface, OTP login, mobile-first
Technology Stack
Frontend
SvelteKit, TypeScript, TailwindCSS
Backend API
Cloudflare Workers, Hono.js, TypeScript
Database
Cloudflare D1 (SQLite at the edge)
Protection
Cloudflare Turnstile, per-IP rate limiting
Notifications
Resend email · MSG91 SMS (DLT)
Accounts are onboarded by our team — contact us for a demo and pricing.
waterflow
Delivery routes, can-deposit ledger & monthly statements for packaged-water plants
Key Features
- Route-wise delivery logging that keeps working offline and syncs safely
- Can & deposit tracking per customer — never lose a can again
- Monthly statements with UPI payment deep links (no gateway fees)
- Automatic overdue reminders; rate snapshots keep old bills unchanged
- CSV exports for accounts; English + Telugu, OTP login
- Idempotent sync — double-taps and reconnects never duplicate entries
Technology Stack
Frontend
SvelteKit, TypeScript, TailwindCSS
Backend API
Cloudflare Workers, Hono.js, TypeScript
Database
Cloudflare D1 (SQLite at the edge)
Protection
Cloudflare Turnstile, per-IP rate limiting
Offline
PWA + client-UUID idempotent sync
Notifications
Resend email · MSG91 SMS (DLT)
Accounts are onboarded by our team — contact us for a demo and pricing.
sunnahfast
Sunnah fasting reminders — the night before, 7 PM your time, Insha Allah
Key Features
- Reminders before Mondays & Thursdays, the White Days (13–15), Ashura, the first nine days of Dhul Hijjah incl. Arafah, and six of Shawwal
- A short Jumuah email every Thursday evening — Surah al-Kahf, salawat & the hour of acceptance, Insha Allah
- Lands at 7 PM in your own local timezone — the evening before, so suhoor is never a scramble
- Tabular Hijri calendar with a ±1-day "sync with your local moon sighting" adjuster (defaults to India)
- Hijri ↔ Gregorian converter and a subscribable Islamic-dates calendar feed (.ics) for Google, Apple & Outlook
- Every email carries a hadith with its reference for the fast ahead
- Double opt-in signup and a genuine one-click unsubscribe — no dark patterns
- Free forever, Insha Allah — no account, no card, ever
Technology Stack
Frontend
SvelteKit, TypeScript, TailwindCSS
Backend API
Cloudflare Workers, Hono.js, TypeScript
Database
Cloudflare D1 (SQLite at the edge)
Protection
Cloudflare Turnstile, per-IP rate limiting
Resend (confirmation & nightly reminders)
Scheduling
Hourly Cron Trigger, timezone-aware
Free forever, Insha Allah — no account, no card, just an email and a one-click unsubscribe whenever you like.
Smartable
API-First Education ERP with Smart Auto Timetabling
Key Features
- Automated timetable generation using Google OR-Tools
- Multi-tenant architecture with organization isolation
- Multi-campus support with branch scoping
- JWT authentication with refresh token rotation
- Teacher absence & substitution management
- Holiday management with automatic scheduling exclusion
- PDF export with 5 different views
- Advanced analytics & reporting
- Break supervision roster automation
- Conflict detection & constraint validation
Technology Stack
Frontend
SvelteKit, TypeScript, TailwindCSS
Backend API
Cloudflare Workers, Hono.js, TypeScript
Database
Cloudflare D1 (SQLite at the edge)
Computing
Modal.com (Serverless Python), Google OR-Tools, ReportLab
Authentication
Custom OAuth implementation, JWT + Refresh Tokens, Bcrypt
Infrastructure
- Cloudflare Workers: Edge API with global distribution
- Cloudflare D1: SQLite database at the edge
- Modal.com: Serverless Python for OR-Tools computation
- GitHub Actions: Automated CI/CD pipeline
Quality & Testing
- Comprehensive Testing: 19 route test suites
- Integration Tests: End-to-end API testing
- CI/CD Pipeline: Automated testing on every commit
- Type Safety: Full TypeScript implementation
Architecture
Users (Web Browser)
↓
Cloudflare Workers (Edge Runtime)
├── SvelteKit UI (SSR/SPA)
└── REST API (170+ endpoints - internal calls)
↓
├── Cloudflare D1 Database (26 tables, SQLite at edge)
└── Modal.com Python Service (OR-Tools + ReportLab)
Note: The SvelteKit UI and REST API are served from the same Cloudflare Worker. The REST API interacts directly with both D1 (for data persistence) and Modal.com (for timetable generation & PDF export).
170+
API Endpoints
26
Database Tables
19
Test Suites
5
PDF Export Views
Technologies We Support
We provide expert services, integration support, and custom software development for these platforms and tools
IAM
Auth0 
AWS Cognito 
Firebase Auth 
Keycloak 
Microsoft Entra ID 
Okta 
Oracle IDM & IAM 
SupabaseAuthorization & Policy
Agent Identity & Non-Human Identities
Gateways & CDNs
Programming
IaC & Automation
Testing Tools
Databases
Serverless
Monitoring & Observability
Message Queues & Event Streaming
Cloud Platforms
AI Tools
AI Agent Frameworks
AI Model Providers
AI Security & Guardrails
Trusted by Industry Leaders
Leading companies trust us for IAM, API security, AI security, and software development services
How We Engage
No black boxes, no lock-in — a clear path from first call to production.
Assess
We map your identity, API, and AI surfaces — providers, tokens, gateways, agents — surface the risks that matter, and agree on scope and outcomes.
Architect
You get a concrete, standards-based design — OAuth 2.1, OIDC, fine-grained authorization, gateway policy — matched to your stack, not a vendor's roadmap.
Build & Integrate
We implement alongside your team: IdP configuration, custom services, MCP gateways, policies, and tests — reviewed, documented, and shipped to production.
Enable & Hand Over
Docs, runbooks, and hands-on training so your team owns the result outright from day one.
Support & Evolve optional
Most teams run independently from here. If you'd rather keep us close, managed IAM & support retainers cover monitoring, upgrades, key rotation, and incident response — the same engineers who built it, on call as your identity estate grows.
Questions first? Read the FAQ or get in touch — a short intro call is usually enough to know if we can help.
Frequently Asked Questions
Straight answers to the questions we hear most.
We're a specialist consultancy for identity & access management (IAM), API security, and AI & agent security. We design, build, and harden authentication, authorization, and identity infrastructure for humans, machines, RPA bots, and AI agents — from enterprise SSO and customer identity to MCP security, non-human identities, and fine-grained authorization.
Every engagement starts with a conversation about your stack and goals. From there we scope the work together — a focused assessment, a fixed-scope project, or ongoing advisory — and work remote-first with teams worldwide. Deliverables are standards-based (architecture, code, policies, runbooks) and your team owns them outright: no lock-in. See how we engage.
Email [email protected] or use the contact section. A short intro call is usually enough to tell whether — and how — we can help. No obligation, no hard sell.
Yes. All 27 micro-tools are free to use with no sign-up. Each one mirrors a check we run in real engagements — if a report surfaces gaps, that's exactly the kind of problem we help close.
Yes — 133 byte-sized lessons across 12 tracks, with 99 hands-on labs, free and with no account needed. Score 80%+ on the final exam and you earn a certificate with a verifiable ID that anyone can check at integrauth.com/verify.
The Model Context Protocol (MCP) is how AI agents connect to tools and data. Every MCP server is a new door into your systems: if it's over-privileged or weakly authenticated, an agent — or an attacker using prompt injection — can walk through it. We secure MCP deployments end to end, from gateway architecture to tool-level authorization — see MCP Security.
Yes. We're vendor-independent and work with what you already run — Auth0, Keycloak, Okta, Microsoft Entra ID, AWS Cognito, Firebase, Supabase, Oracle IDM — plus open standards and open source like OpenFGA, OPA, and SPIFFE.
No. We're independent: we recommend what fits your requirements and budget, we only list technologies we actually work with, and we're equally happy building on open source.
From startups shipping their first login to enterprises running thousands of workloads and agents. Engagements are sized accordingly — a small focused review is as welcome as a multi-quarter program.
Yes. Enablement is part of most engagements, and IntegrAuth Academy is our free public baseline. We also run tailored workshops on OAuth/OIDC, token security, fine-grained authorization, and AI-agent security.
Get in Touch
Ready to secure your identities, APIs, and AI agents? Let's discuss your needs.
Email Us
[email protected]IntegrAuth
Securing Your Digital Future — Humans, Machines & AI Agents