Skip to main content
Adopting MudraID is small, well-scoped work. This page is the honest picture of the effort, so you can plan it before committing engineering time.

​
Two touchpoints

You integrate on one or both sides, depending on what you build. Neither side requires you to run MudraID infrastructure. You add a library; MudraID is the managed service behind it.

​
What the agent side looks like

Register an agent identity and link an OAuth machine client to it. Register the client’s public key (the private key stays with you) and get a grant approved for the exact resource and scopes you need. Then use the SDK’s MachineAgent, which returns ordinary requests.Response objects — tokens are fetched, attached, and refreshed for you. Each resource you call needs its own approved grant, and each resource/scope configuration gets its own SDK instance.

​
What the platform side looks like

You add the middleware to your web app and point it at a scopes file that maps each route to the permission it requires, plus the issuer and audience it should accept. From then on, the middleware verifies every request locally before it reaches your code. Your existing route handlers don’t change — no auth code sprinkled through them. Defining scopes is the main design step: decide what permissions your API exposes (for example orders:read, orders:write) and which routes need each.

​
Adding live enforcement

When an action must be decided against current authority and containment, not just a valid token, register an enforcement adapter and put it in front of that action. It calls MudraID’s /decide per protected action and refuses anything that cannot be decided safely. What exists today:

​
A typical rollout

  1. Register your agent and its OAuth client, or your platform, with MudraID.
  2. Grant scopes — approve what each client may do, or define what your platform’s routes require.
  3. Integrate — add the SDK or the middleware.
  4. Verify — run a test call end to end and confirm allowed calls pass and denied calls fail.
  5. Go live — roll it out to production traffic. Production clients use private_key_jwt; a client secret there needs an explicit organization approval.
Most teams do a working token-and-scope integration in a day, with scope design being the part worth thinking through.

​
What your team owns

  • The client’s private key (or client secret), stored in your environment, and your platform’s scope definitions.
  • The decision of which agents get which permissions.

​
What MudraID owns

  • Issuing identities and tokens, publishing and rotating the keys your middleware verifies against, deciding protected actions, processing containment, and keeping the evidence.

​
Next