# Identity

URL: /code/platform/identity · Id: `capability:identity`

> Identity signs in humans and agents, issues every key and session, and connects single sign-on and directory sync for Customers.

Identity signs in [Humans](/business/nouns/human) and [Agents](/business/nouns/agent), issues every key and token, and connects single sign-on and directory sync for [Customers](/business/nouns/customer). One issuer serves the whole platform.

## Contract
| Who | Signs in by | Holds |
| --- | --- | --- |
| A Human | Magic link or a connected account, with multi-factor required | Signed-in [Apps](/business/nouns/app), plus keys for code |
| An Agent | Its own identity, [minted](/business/nouns/agent/mint) per Agent | One `api.sb` token, a [Mailbox](/business/nouns/mailbox) and a chat user |
| CI and machines | Exchanging an OIDC token for a scoped token | No stored secret |
| A Customer's people | Single sign-on (SAML or OIDC) into the Customer's [Tenant](/business/nouns/tenant) | [Roles](/business/nouns/role) in that Tenant, kept current by directory sync (SCIM) |

An exchanged token lasts 15 minutes and names both the [Person](/business/nouns/person) and the acting Agent. A token narrows its scope, never widens it, and no admin token exists outside Identity.

An [Integration](/business/nouns/integration)'s tokens reach the platform at call time and never reach agent code. Every token served is an [Event](/business/nouns/event).

```bash
# The CLI looks for a key in this order: environment variable, credentials file, browser sign-in
npx startup-builder login
```

## Verbs
| Verb | Object | Event |
| --- | --- | --- |
| [Human.invite](/business/nouns/human/invite) | [Human](/business/nouns/human) | [`Human.invited`](/business/events/Human.invited) |
| [Agent.mint](/business/nouns/agent/mint) | [Agent](/business/nouns/agent) | [`Agent.minted`](/business/events/Agent.minted) |
| [Mandate.revoke](/business/nouns/mandate/revoke) | [Mandate](/business/nouns/mandate) | [`Mandate.revoked`](/business/events/Mandate.revoked) |

## Interfaces
- [API](/code/api/reference)
- [SDK](/code/sdk/reference)
- [CLI](/code/cli/reference)
- [MCP](/code/mcp/reference)

## Example
`cohortly.io`, retention analytics [Software](/business/nouns/software), sells to a 400-person company that requires single sign-on. The Customer's IT admin connects their directory once. When an employee leaves, directory sync removes them from the Tenant and their tokens stop working.