Skip to content
VeraID Docs

Welcome to VeraID

VeraID is the Unified Identity Security Platform for your organization. It governs every identity — human and non-human — from a single control plane. Service accounts, API keys, CI/CD tokens, AI agents, IoT devices, Kubernetes pods, and now with v2.0, your human users too.

Non-human identities (NHIs) outnumber human users by a factor of 45:1 in the average enterprise. With VeraID v2.0, you no longer need a separate identity provider for your human workforce. VeraID combines OIDC/SAML identity provider, user directory with SCIM, enterprise federation, and conditional access alongside full NHI governance — all from one platform.

Get started

Quickstart

Install the SDK, initialize a client, and make your first API call in under five minutes. Go to Quickstart →

Core Concepts

Understand identities, credentials, policies, risk scoring, and lifecycle states. Read Core Concepts →

Credentials

Issue, rotate, and revoke credentials with envelope encryption and TTL controls. Manage Credentials →

AI Agent Security

Govern AI agents with budget controls, prompt injection detection, and MCP oversight. Secure AI Agents →

API Reference

Full REST API documentation with request/response examples for every endpoint. View API Reference →

v2.0: Identity Provider

VeraID v2.0 adds full identity provider capabilities, making VeraID the single platform for both human and non-human identity governance.

OIDC Provider

Act as an OpenID Connect identity provider for your applications. OIDC Guide →

SAML 2.0 IdP

Enable SAML-based SSO for enterprise and legacy applications. SAML Guide →

Authentication Methods

Passwords, passkeys, magic links, and social login — all configurable. Auth Methods →

User Directory & SCIM

Built-in user directory with SCIM 2.0 provisioning for Okta and Entra ID. Directory Guide →

Conditional Access

Context-aware policies for IP, device trust, risk-based step-up MFA, and more. Conditional Access →

Key capabilities

VeraID delivers end-to-end identity security across the entire NHI lifecycle:

Discovery and inventory

Continuously scan your cloud environments, CI/CD pipelines, and SaaS platforms to build a real-time inventory of every non-human identity. Correlate the same identity across AWS, GCP, and Azure to eliminate blind spots.

Lifecycle governance

Manage identities from creation through decommissioning. Enforce attestation workflows, track ownership chains, and automate offboarding cascades when a human owner departs the organization.

Risk scoring

Every identity receives a dynamic risk score from 0 to 100, calculated from behavioral signals, credential hygiene, policy compliance, and exposure analysis. Scores update continuously as conditions change.

Policy-based access control (PBAC)

Define fine-grained access policies with conditions based on time windows, IP ranges, rate limits, resource scopes, and identity attributes. Policies evaluate in real time with deterministic ALLOW or DENY outcomes.

AI agent security

Purpose-built controls for autonomous AI agents — including spend budget limits, token usage tracking, prompt injection detection, tool-call governance, and MCP (Model Context Protocol) server oversight.

Blast radius analysis

Simulate “what-if” scenarios to understand the impact of a compromised identity. Map attack paths, visualize dependency chains, and quantify blast radius before an incident occurs.

Just-in-time (JIT) access

Issue short-lived, scoped credentials on demand. JIT tokens expire automatically, reducing the window of exposure and eliminating long-lived secrets from your environment.

Compliance automation

Generate audit-ready reports for SOC 2, ISO 27001, NIST 800-53, and PCI DSS. Immutable audit logs backed by TimescaleDB hypertables provide a tamper-proof record of every identity event.

Identity provider (v2.0)

Act as a fully compliant OIDC and SAML 2.0 identity provider for your applications. Register OIDC clients, configure SAML service providers, and authenticate users with passwords, passkeys, magic links, or social login — all from VeraID.

User directory and SCIM (v2.0)

Manage human users alongside NHIs in a unified directory. Automate provisioning and deprovisioning with inbound SCIM 2.0 from Okta and Microsoft Entra ID, or push changes outbound to downstream applications.

Enterprise federation (v2.0)

Connect external identity providers via OIDC or SAML federation. Domain-based routing automatically directs users to the correct IdP, and just-in-time provisioning creates VeraID accounts on first login.

Conditional access (v2.0)

Enforce context-aware policies that evaluate IP address, device trust, risk score, and authentication method. Simulate policies in dry-run mode before enforcing them, and use risk-based step-up MFA for high-risk scenarios.

How it works

  1. Connect your cloud providers, CI/CD systems, and SaaS platforms via built-in integrations.
  2. Discover every non-human identity and map human-to-NHI ownership relationships.
  3. Assess risk with automated scoring, policy evaluation, and blast radius analysis.
  4. Govern access with PBAC policies, JIT credentials, and lifecycle automation.
  5. Monitor continuously with real-time alerts, behavioral anomaly detection, and immutable audit trails.

Architecture overview

VeraID is designed for enterprise-grade reliability and security:

LayerTechnologyPurpose
ApplicationNext.js on Google Cloud RunDashboard, API routes, and business logic
DatabaseTigerData (TimescaleDB)Core entities, time-series audit logs, row-level security
CacheUpstash RedisRate limiting, session caching, pub/sub events
StorageGoogle Cloud StorageEncrypted backups and data exports
EncryptionEnvelope encryption (AES-256-GCM)All credentials encrypted at rest and in transit

All data is isolated per organization using PostgreSQL row-level security (RLS). Every API request is scoped to the authenticated tenant — there is no way to access another organization’s data.