Know Your Agent — biometric action authorization
AI agents send emails, make purchases, sign contracts, and access sensitive data on your behalf. SynAuth ensures every action is verified by the right human — biometrically.
Try it in 60 seconds — no signup, no install. Available now on PyPI.
AI agents are gaining real-world capabilities — but the approval mechanisms haven't kept up.
Sources: Gravitee State of AI Agent Security 2026, MCP Server Audit 2026
Slack buttons and email confirmations train users to click “approve” without reading. The signal degrades until approval is meaningless.
“Someone clicked a button” proves Slack access, not identity. For regulated industries, that distinction is a compliance gap.
When an agent acts, who approved it? When? Were they authorized? Most systems can’t answer these questions with cryptographic certainty.
Allow everything or block everything. No granularity for “auto-approve low-risk, require biometric for high-risk” — the controls agents actually need.
46% of organizations report agents fabricating, leaking, or misusing credentials. Agents that hold API keys are agents that can lose them. SynAuth’s vault means your agent never touches the keys.
Three steps. Under five seconds. The authorized human verifies — not a proxy.
Your AI agent calls SynAuth’s API with the action details — what it wants to do, the risk level, and any relevant metadata.
Your iPhone receives an instant notification with the action details. Tap to review — see exactly what the agent wants to do, the risk level, and the context.
Approve or deny with biometric verification. Face ID proves it was you — not someone with access to your Slack, not a compromised session, not a forwarded email. You.
60 seconds. No signup. Just your browser and any authenticator app.
Not a demo. A production authorization layer with the controls agents actually need.
Auto-approve low-risk scheduling. Require biometric for purchases over $100. Deny anything from untrusted agents. Your rules, enforced automatically.
Per-agent, per-period spending caps. Daily, weekly, or monthly. A hard constraint that overrides auto-approve rules — even trusted agents hit the ceiling.
Seven action types with four risk levels. Color-coded in the iOS app for instant context.
Every action logged — who requested it, when, what the risk level was, how it was resolved, and the biometric verification timestamp. Compliance-ready from day one.
Each agent only sees its own requests. No cross-agent data leakage. Scoped API keys ensure agents can’t impersonate each other.
Your agent never holds API keys. Credentials live behind biometric gates — SynAuth executes on behalf of the agent after approval. No keys to leak, hallucinate, or misuse.
Get notified the instant a request is approved or denied. No polling. Your agent’s workflow continues the moment the human decides.
The gap between “someone clicked approve” and “the authorized human biometrically verified” is the gap between convenience and compliance. Mapped to NIST SP 800-63-4 Authentication Assurance Levels.
| Approval method | What it proves | NIST AAL | Assurance |
|---|---|---|---|
| Slack button | Someone with Slack access clicked a button | Below AAL1 | Low |
| Email confirmation | Someone with email access clicked a link | AAL1 | Low |
| OAuth / SSO | A valid session exists for this account | AAL1–2 | Medium |
| TOTP / Authenticator | Someone has the registered device | AAL2 | Medium |
| SynAuth (Face ID) | The specific authorized human is physically present | AAL3 | High |
Most Know Your Agent (KYA) solutions verify who the agent’s human is — identity. SynAuth verifies that the human approved this specific action — authorization. No other agent authorization system operates at AAL3.
Trade execution, fund transfers, portfolio rebalancing. Regulators require proof that the authorized individual approved each transaction.
Accessing patient records, ordering prescriptions, modifying treatment plans. HIPAA compliance demands identity verification, not account verification.
Signing contracts, accepting terms, filing documents. When an AI agent acts with legal authority, you need biometric proof.
Deploying code, modifying infrastructure, accessing production data. High-impact system actions need more than a Slack emoji to proceed.
Python SDK. REST API. MCP server. Drop SynAuth into your existing agent workflow.
Full-featured client for any Python agent.
pip install synauthfrom synauth import SynAuthClient
client = SynAuthClient(api_key="aa_...")
result = client.request_action(
action_type="purchase",
title="Buy API credits",
amount=49.99,
)
status = client.wait_for_result(result["id"])Drop-in biometric approval for Claude and any MCP-compatible agent.
pip install synauth-mcp// claude_desktop_config.json
{
"mcpServers": {
"synauth": {
"command": "synauth-mcp",
"env": {
"SYNAUTH_API_KEY": "aa_..."
}
}
}
}Direct HTTP for any language or framework.
https://synauth.fly.dev/api/v1curl -X POST https://synauth.fly.dev/api/v1/actions \
-H "X-API-Key: aa_..." \
-H "Content-Type: application/json" \
-d '{
"action_type": "purchase",
"title": "Buy API credits",
"amount": 49.99
}'No tiers. No metering. No surprises. Face ID verification, credential vault, rules engine, audit trail — all of it, for less than a dollar.
Try it. See if it works.
Everything. No limits.
Need enterprise features? Self-hosted deployment, SSO, compliance reports, multi-user approval workflows — let’s talk.
Any request your agent sends through SynAuth — whether it’s biometrically approved, auto-approved by the rules engine, denied, or expired.
Yes. SynAuth works with any agent that can make HTTP requests. Use the Python SDK, REST API, or MCP server. Works with Claude, GPT, Gemini, open-source models, and custom agents.
Action metadata is stored with AES-256 encryption at rest. Face ID biometric data never leaves your iPhone — it’s verified locally by the Secure Enclave.
Currently, yes. SynAuth uses Face ID on iPhone for biometric verification. Android support is on the roadmap.
KYA frameworks verify who an agent’s human is — identity. SynAuth goes further: it verifies that a specific human biometrically approved a specific action. Identity tells you who is responsible. SynAuth proves they authorized it.
Because biometric agent authorization should be everywhere, not just where budgets allow. The goal is to make SynAuth the standard — and standards need to be accessible.
New requests return a limit-reached response. Your agents won’t break — they’ll get a clear signal. Upgrade to Pro for unlimited actions, instantly.
25 free actions. No credit card required.
pip install synauth