Joining the private beta

Zynth Auth is in private beta. Public sign-up is closed: a new organization exists only because Zynth invited you. This page is what an invited tester needs — what you receive, what to do first, and what the beta does and does not promise.

Private beta, AI-first operations. Zynth Auth is built and operated with AI agents in the loop and may change or be interrupted without notice. It carries no service level during the beta. Back up your own data; Zynth does not guarantee its retention during the beta. You acknowledged this when you applied; it applies to everything you connect.

Applying

Apply on the early-access page. Applications are reviewed in small groups and the ones selected receive an invitation by email. An application does not create an account, and an invitation is not guaranteed. To have your application deleted, email the address on that page.

What you receive

One beta invite code (zbi_…), issued to your email address, valid for a stated number of days, in one of two modes. The email says which.

Bootstrap mode — your agent opens your organization

You connect through Zynth's own agent-native onboarding (agent-driven onboarding). Your MCP-capable agent calls the bootstrap with your email, your organization name, and the invite code; you — the human — verify the short code, prove your mailbox, set a passkey, review what the agent proposed, and approve. The agent then receives its own governed credential and you are the organization's owner.

The code is bound to your email and to this door: a different address, an expired or revoked code, or a code issued for the other mode is refused with one message, and the code is consumed the moment your organization is created — not when the bootstrap is parked.

curl -X POST "$BASE/api/v1/onboard/bootstrap" -H "Content-Type: application/json" \
  -d '{"organization_name":"Acme Inc","human_email":"you@acme.example","invite_code":"zbi_…",
       "client_info":{"name":"claude-code","platform":"cli","model":"claude-fable-5"}}'

Provisioned mode — Zynth opened your organization for you

Zynth created your organization, a passwordless owner account for your email (you receive a set-password email — set a passkey right after), and an agent pre-registered with the authority you asked for. That agent cannot authenticate yet: the invite code is a claim code. Your agent presents it once and receives its first credential; nobody at Zynth ever sees it.

curl -X POST "$BASE/api/v1/agents/claim" -H "Content-Type: application/json" \
  -d '{"claim_code":"zbi_…","owner_email":"you@acme.example"}'
# → {"agent_id":"…","tenant_id":"…","credential":"agt_…","token_type":"bearer"}   (shown once)

A second claim is refused; a revoked or expired code is refused; a code issued for the other mode is refused — all with the same message. Store the credential where your agent keeps secrets and mint tokens at POST /api/v1/agents/token as usual.

Your organization waits for you before it can grow

An organization Zynth opened for you starts quarantined, and stays that way until you sign in for the first time. Your agent can claim its credential, get tokens and read; what it cannot do yet is grow the organization — invite members, add an auto-join domain, create API keys or OAuth clients, add a webhook, connect an identity provider or SCIM, or apply a manifest. Those answer 403 with the reason, and the reason names the remedy: sign in once.

This is the same restriction an organization opened by a bootstrapping agent sits under until its human approves — the principle is that no organization grows before a person has arrived in it. Signing in lifts it immediately and permanently; there is nothing else to click.

What to do first

Sign in to the console at https://auth.zynthmedia.com and add a passkey. In provisioned mode this is also what lifts your organization's quarantine, so do it before your agent starts configuring anything.
Review the agent under AI Agents: its governance band, its delegation, its kill switch.
Connect what you told us you would test, and tell us what breaks.

What the beta does not include

Purchases and plans (nothing is for sale), a service level, guaranteed data retention, and public sign-up. Everything the platform enforces is live: passkeys and MFA, the OpenID Provider, the MCP gateway, agent containment, the audit spine — and it is being tested on you as well.