# Hanzo IAM — Hanzo AI

> Identity and access management for every service. OIDC SSO, fine-grained RBAC, organization scoping, and audit logs.

Identity

# Hanzo IAM

The sign-in behind every Hanzo service.

[API reference](https://docs.hanzo.ai/docs/openapi/iam)[Discovery document](https://hanzo.id/.well-known/openid-configuration)[Source](https://github.com/hanzoai/iam)

hanzo.id

- PKCE01
- Passwords02
- Refresh tokens03
- A second factor04
- Federation05
- Signing keys06
- Organizations07
- Authorization08

Authorization code with PKCE, always S256.

The passwords that do exist are argon2id digests, and a scheme IAM does not recognize fails closed.

Refresh tokens are single-use and kept only as a hash. Presenting a spent one revokes the whole family, so a stolen token cannot outlive its session.

A second factor is an authenticator app, a code by SMS or email, or a passkey. Adding or dropping one signs the account out of every other browser.

Sign-in arrives from Google, from GitHub or from any OIDC issuer you name, and SCIM 2.0 keeps a directory in step.

Tokens are signed RS256, with ML-DSA-65 available per certificate and published in the same JWKS.

Every organization is a tenancy boundary, and membership travels in the token.

What you may reach once signed in is Authz’s to decide, reading the same token.

Paste and ship

Paste this into any agent. It reads the skill manifest and calls IAM from there.

Agent promptapi /v1/iamCopy

```
Read https://hanzo.ai/skill.md and use Hanzo IAM in my project. Start with: hanzo iam whoami
```

Related capabilities

[AuthzFine-grained access](https://hanzo.ai/authz)[KMSManaged keys](https://hanzo.ai/kms)[SecretsStore once, sync everywhere](https://hanzo.ai/cloud/secrets)

## Get IAM

Identity + access (hanzo.id)

License: Apache-2.0[hanzoai/iam](https://github.com/hanzoai/iam)

[Deploy to Cloud](https://platform.hanzo.ai/deploy)