Loading…
M7 Identity Apps and AI agents
Let apps act with a person's permission, or let services and AI agents connect with their own identity. Choose the API access each one needs, and revoke it when it is no longer needed.
M7 supports OAuth 2.0 and OpenID Connect, with additional M7 controls for integrations that need them. OpenID Connect identifies the person who signs in; OAuth provides the permissions an app uses to access protected APIs. Choose the access each app needs for its job. A reporting tool might read records, while a publishing tool submits content. Your APIs check those permissions when handling requests. Change or revoke access as the work changes.
Let an app request permission to use an API for a person. Browser applications can take the person through an authorization flow. For tools with limited browser access, device authorization lets the person approve access in a browser while the tool waits for the result. Use the M7 SDK to work with the supported authorization flows and manage the credentials your integration needs. Personal access tokens are another option for integrations that accept them. Choose the method that fits how the person will use your app.
Give a background service or AI agent its own identity. Register a service client, grant the API access it needs, and let it request tokens using its own credentials. OAuth's client-credentials flow supports this work without an interactive user sign-in. For new unattended integrations, start with machine access tokens. They give your service a standard way to obtain and present scoped, expiring access. Machine API keys are also an option where the receiving service supports them.
Give scripts and AI agents a familiar way to connect. OAuth and OpenID Connect provide established integration patterns, while the M7 SDK keychain gives your tools a common place to manage configured credentials. Provide an agent with your API documentation or tool definitions and the permissions needed for its task. An agent that can use your SDK tools can authenticate and call the APIs you make available to it. This reduces the custom authentication setup you need to explain for each integration. You define the available actions and access limits; your tools use the same authentication foundation across automated workflows.