thunder-id/thunderid
ThunderID is a high-performance, open-source identity stack designed for developers to secure and manage access for humans, AI agents, and workloads through fully composable identity flows.
What it solves
ThunderID is an Identity and Access Management (IAM) engine designed to secure access for humans, AI agents, and machines. It addresses the need for agent-native identity management, allowing AI agents to be treated as first-class identities with delegated authority and traceability, while also bridging the gap for decentralized identity (DIDs and verifiable credentials) and providing post-quantum-safe security.
How it works
ThunderID operates as a lightweight, containerized IAM platform that supports both traditional and decentralized identity ecosystems. It uses declarative YAML resource definitions for GitOps-ready configuration and an immutable runtime. The system supports OAuth 2.1, OpenID Connect, and Verifiable Credentials (OpenID4VCI/OpenID4VP), and provides a variety of built-in executors for user journeys like login and registration.
Who it’s for
It is built for developers who need to secure applications, APIs, and agent-driven workflows across on-premises and cloud environments, specifically those integrating AI agents or decentralized identity standards.
Highlights
- Agent-native identity: Treats AI agents as first-class identities with consent-aware access and support for verifiable credentials.
- Decentralized identity support: Practical implementation of DIDs, digital wallets, and trust registries.
- Post-quantum-safe security: A crypto-agile foundation that supports post-quantum-safe algorithms and hybrid transition approaches.
- Developer-first experience: Includes a Console UI, REST APIs, SDKs, and a dedicated MCP server for AI agents to manage IAM.
- Standard-compliant: Supports OAuth 2.1, OpenID Connect, WebAuthn, and IdP federation (Google, Microsoft, GitHub).
- GitOps-ready: Uses YAML definitions for all entities, making it suitable for automation and versioning.