Identity for humans · AI agents · workloads

Identity, in your DNA.

HelixIAM is the identity platform for the agentic enterprise. Authenticate, authorize, and govern every identity — human and non-human: your people, their AI agents, and the workloads acting on their behalf. Keycloak-class SSO, MFA, and federation, purpose-built agent and workload identity, and EU data sovereignty — from one platform.

Book a demo Explore the platform
  • Open standards — OIDC, SAML, FAPI, WebAuthn. No lock-in.
  • EU-sovereign & self-hostable
  • Purpose-built for AI-agent & workload identity

Built for the teams securing modern software — from scale-ups to the public sector

Your platform
Your bank
Your SaaS
Your agency
Your ministry
One fabric, two strands

Every identity your systems touch — on one platform.

Most IAM was built for humans and had machines bolted on later. HelixIAM treats human and non-human identity as the two strands of the same helix — issued, governed, and revoked the same way.

Human identity

Passwordless passkeys, adaptive MFA, SSO and federation for every person — employees, customers, and citizens.

  • Passkeys & WebAuthn
  • Adaptive, risk-based MFA
  • OIDC · SAML · social · LDAP
  • EU eIDs out of the box

Non-human identity

First-class identity for AI agents and workloads — scoped tokens, on-behalf-of delegation, and keyless federation.

  • AI-agent identities
  • RFC 8693 delegation (act-as)
  • Workload Identity Federation
  • Attenuated, kill-switchable
Why HelixIAM

Four reasons teams switch.

Built for AI agents & workloads

Not bolted on. HelixIAM treats AI agents and machine workloads as first-class subjects — with delegation, attenuation, and governance most IAMs simply don't have.

Learn more

Sovereign & European

Your realm, your keys, your continent. Self-hostable, per-realm signing keys, EU data residency, and DigiD / eHerkenning / eIDAS built in — not a plugin.

Learn more

Standards to the core

OAuth 2.1, OIDC, SAML 2.0, WebAuthn, FAPI, DPoP, RFC 8693 & RFC 8628. Open protocols, zero lock-in, and a clean migration path off Keycloak.

Learn more

An afternoon, not a quarter

A polished admin console, SDKs, a Terraform provider, and full config-as-code. Realms, clients, and flows are versioned like the rest of your stack.

Learn more
New — Non-Human Identity

Give your AI agents a real identity.

Agents act on behalf of users and call tools autonomously. HelixIAM issues each agent its own identity, mints on-behalf-of tokens (RFC 8693) that carry the user and the agent, and lets you attenuate scope, require consent, and pull a kill-switch — instantly.

  • Agent registry & lifecycle
  • Delegation with intersected scope
  • Workload Identity Federation (keyless)
  • MCP-ready OAuth 2.1 auth
Explore agent identity Workload identity
The whole platform

Everything a modern IAM needs — and the next thing too.

A complete, Keycloak-class feature set. All shipped. All documented.

Authentication

  • Passkeys / WebAuthn (FIDO2)
  • TOTP, SMS-OTP, Email-OTP, HOTP
  • Device push + mobile SDK
  • Magic-link passwordless
  • Recovery codes
  • Risk-based / adaptive step-up

SSO & Federation

  • OpenID Connect provider
  • SAML 2.0 IdP & SP
  • Social & OIDC brokers
  • LDAP / Active Directory
  • JIT provisioning + account linking
  • Single Logout (front, back, SAML)

Non-human identity

  • AI-agent registry & lifecycle
  • RFC 8693 token exchange (act-as)
  • Workload Identity Federation
  • Scoped & attenuated tokens
  • Consent + kill-switch
  • MCP-ready auth (OAuth 2.1)

European eIDs

  • eIDAS (EU cross-border)
  • eHerkenning (NL business)
  • DigiD (NL citizen)
  • Assurance levels
  • Per-realm branding
  • NL-i18n

Developer & admin

  • Keycloak-class admin console
  • TypeScript SDK + adapters
  • Terraform provider (IaC)
  • Config-as-code (import/export)
  • Keycloak importer
  • OpenAPI + SCIM 2.0

Security & compliance

  • FAPI + mTLS-bound tokens
  • DPoP (RFC 9449)
  • Per-realm KMS keys + rotation
  • Searchable audit log + SIEM
  • GDPR rights tooling
  • Brute-force + password policy
Easy on purpose

From zero to secure login in an afternoon.

01

Spin up a realm

One container or a Helm chart. Import your Keycloak realm, or start fresh — every setting is config-as-code.

02

Add your app

Register an OIDC or SAML client in the console, or declare it in Terraform. Passkeys and MFA are on by default.

03

Ship & govern

Wire the SDK, go live, and watch every human, agent, and workload in one audited, revocable place.

login.ts
// Passwordless in three lines — the SDK handles PKCE, passkeys & refresh.
import { HelixIAM } from "@helixiam/sdk";

const helix = new HelixIAM({ realm: "acme", issuer: "https://id.acme.eu" });
await helix.login();  // passkey / MFA / SSO — your flow, your rules
Sovereign by design

Your realm. Your keys. Your continent.

HelixIAM runs where you do — your cloud, your data centre, air-gapped if you need it. Per-realm signing keys never leave your control, and Europe's eIDs are first-class, not a plugin.

  • EU data residency & self-hosting
  • Per-realm KMS keys + rotation
  • DigiD · eHerkenning · eIDAS built in
  • GDPR rights tooling included
European eIDs & sovereignty
3
identity subjects
humans · agents · workloads
9
auth factors
passkeys to device push
100%
open standards
no proprietary lock-in
EU
sovereign by design
your keys, your realm

See HelixIAM on your own stack.

A 30-minute demo: realms, agents, workload identity, and a live migration off Keycloak — mapped to your use case.

Book a demo Read the docs

No credit card. Self-hostable. Engineered in Europe.