Xirag identity gateway for agentic ERP
Type a work email and Gate routes the sign-in straight to your organization's own OIDC or SAML identity provider, without Xirag ever importing or storing that directory. Their identity provider, your login screen.
In development, early access- Work email
- Resolve IdP
- Your IdP
- Signed, in
- priya@acme-traders.example
- Realm
- Acme Traders (demo), OIDC
- Assertion
- HMAC-SHA256 signed, short expiry
- Device
- First device registered
- DeviceSecond device for Priya (demo) waits for an adminPending
An identity gateway with your provider as source of truth
Gate is a broker, not a copy machine: nothing about your directory leaves your organization's own identity provider.
Home Realm Discovery
The domain of a work email resolves the right identity provider, with no list of companies to pick from.
Zero directory retention
Xirag never imports, syncs or caches your user directory; every sign-in is brokered live.
Signed, short-lived handoffs
Every handoff back is HMAC-SHA256 signed, checked with a timing-safe comparison, and expires on a server-checked timestamp.
Zero inbound ports
Every exchange is outbound-initiated, so Gate fits networks your security team has already locked down.
Provisioning and devices
The first sign-in from a new company provisions its tenant and an admin seat; a second, unknown device waits for an admin.
Documented to integrate
An OpenAPI 3.1 reference, OAuth 2.1 with PKCE and DPoP, and guides for Web, Windows, Linux and Android.
Status: in development, early access
- Works with standards-based OIDC and SAML identity providers.
- White-labeled: your people see your login screen, not Xirag branding, mid-flow.
Every workflow here works for people on their own. Agents are not offered at launch; they are provided on request later.
Works with
Try Xirag Gate early
Register for early access, or tell us which identity provider your organization runs.