Authentication & Multi-Tenancy

Production-ready OAuth2/OIDC, WebAuthn, multi-tenant isolation, and audit logging. Ship AI products without building auth.

On this page

SystemPrompt provides production-ready authentication, multi-tenant isolation, and audit logging out of the box. Stop building login flows. Start shipping AI products.

OAuth2/OIDC

Full OAuth2 authorization server with OpenID Connect:

# services/oauth/config.yaml
oauth:
  issuer: "https://yourdomain.com"
  token_expiry: 3600
  refresh_expiry: 604800
  scopes:
    - read
    - write
    - admin

Supported flows:

  • Authorization code flow with PKCE
  • Client credentials for service-to-service
  • Token introspection and revocation
  • Standard OIDC discovery endpoints

Agent Authentication

Agents operate with scoped OAuth2 permissions:

# services/agents/assistant.yaml
security:
  oauth2:
    scopes: ["read:content", "write:content"]

The agent can only access what the user authorized. No credential sharing. No privilege escalation.

MCP Tool Authentication

Every MCP tool call is authenticated:

# services/mcp/content-server.yaml
oauth:
  required: true
  scopes: ["content:read"]

When Claude Code or ChatGPT calls your MCP server, the request includes a valid OAuth2 token.

WebAuthn Passwordless

Modern passwordless authentication:

# services/auth/config.yaml
webauthn:
  enabled: true
  rp_name: "Your App"
  rp_id: "yourdomain.com"

Supported:

  • Passkeys (Face ID, Touch ID, Windows Hello)
  • Hardware security keys (YubiKey)
  • Cross-device authentication
  • Phishing-resistant by design

Multi-Tenant Isolation

SystemPrompt is multi-tenant from the ground up. Every user gets isolated access with scoped permissions.

Automatic Isolation

Every request includes tenant context:

# services/agents/assistant.yaml
security:
  oauth2:
    scopes: ["user:{{user_id}}"]
  isolation: per_tenant

Database queries automatically filter by tenant. API responses only include tenant-scoped data. Cross-tenant access is architecturally impossible.

Scoped Permissions

Define what each user can do:

# services/agents/welcome.yaml
card:
  securitySchemes:
    oauth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: "http://localhost:8080/api/v1/core/oauth/authorize"
          tokenUrl: "http://localhost:8080/api/v1/core/oauth/token"
          scopes:
            anonymous: "Public access"
            user: "Authenticated user access"

User Management

Manage users via CLI:

# List users
systemprompt admin users list

# Create user with specific scopes
systemprompt admin users create --email user@example.com --scopes read,write

# Update permissions
systemprompt admin users edit user@example.com --add-scope admin

# Assign user to tenant
systemprompt admin users edit user@example.com --tenant customer-a

See systemprompt admin users --help for all user management commands.

Audit Logging

Every significant action is logged automatically:

  • Agent messages and responses
  • MCP tool calls and results
  • Authentication events
  • Permission checks
  • File operations
  • Content changes

Query Logs

# View recent logs
systemprompt infra logs

# Filter by agent
systemprompt infra logs --agent assistant --limit 50

# Filter by event type
systemprompt infra logs --type mcp.tool_call

# Filter by user
systemprompt infra logs --user user_123

# Follow logs in real-time
systemprompt infra logs --follow

See systemprompt infra logs --help for all log query options.

Structured Log Format

{
  "timestamp": "2026-01-28T10:30:00Z",
  "event_type": "mcp.tool_call",
  "agent_id": "assistant",
  "user_id": "user_123",
  "tenant_id": "tenant_456",
  "tool": "create_content",
  "status": "success"
}

Log Categories

Category Events
Agent agent.message, agent.response, agent.error
MCP mcp.tool_call, mcp.tool_result, mcp.auth_check
Auth auth.login, auth.logout, auth.token_issued, auth.failed
Permission permission.check, permission.denied, permission.granted

Compliance

Multi-tenant isolation and audit logging help with:

  • SOC 2: Access controls, access logging, change tracking
  • GDPR: Data separation, processing records
  • HIPAA: Data segregation, access audit trails
  • Enterprise requirements: Security questionnaires, compliance reports

Export logs for compliance review:

systemprompt infra logs --format json > logs.json

What You Skip

Without SystemPrompt With SystemPrompt
2-4 weeks building OAuth2 Already done
User management code CLI commands
Tenant filtering logic Automatic
Logging instrumentation Built in
Security audit findings Battle-tested

Configuration

View Current Settings

# View auth config
systemprompt admin config show oauth

# View tenant config
systemprompt admin config show tenancy

Create Tenants

# Create a new tenant
systemprompt cloud tenant create --name "customer-a"

# View tenants
systemprompt cloud tenant list

Configure Logging

# services/logging/config.yaml
logging:
  retention_days: 90
  export:
    enabled: true
    format: json
    destination: s3://your-bucket/logs

Next Steps

Previous Next
Complete Workflow Deploying