Launched this week
LumoAuth
Passwordless sign-in and AI agent approvals from your phone
2 followers
Passwordless sign-in and AI agent approvals from your phone
2 followers
LumoAuth is the login and access-control service for your product. Users sign in without passwords: passkeys, magic links, or a push to the Lumo Authenticator app (iOS & Android) where they tap the matching number and confirm with Face ID. The same app lets people approve or deny what your AI agents want to do, like a payment, before it happens. Also: enterprise SSO, SAML, SCIM and roles, all on open standards. SDKs in 6 languages. Free for 10K monthly users.
Free Options
Launch Team
AWS Activate CreditsCredits that fuel your startup’s next milestone
Promoted
Hey Product Hunt 👋
We're maker of LumoAuth. We're a small team passionate about developer experience in agent identity and security.
Why we built it
Two problems kept coming up.
First, passwords are still the weakest part of most products. Moving to passwordless usually means putting together several vendors and an authenticator app you don’t control.
Second, teams are now giving AI agents real access to send emails, change records and make payments. Most of the time, all that stands between the agent and the action is an API key. Nobody gets asked first.
We wanted one service that handles both, with a phone app that keeps a person in charge.
What matters most
Push sign-in through Lumo Authenticator, now live on the App Store and Google Play. Enter your email, tap the matching number, confirm with Face ID or a fingerprint. Number matching is always on, so a stream of push requests can’t trick someone into tapping “approve” by mistake. The app also shows six-digit codes for your other accounts, and these work offline.
People approve what your AI agents do. Call require_approval() before a sensitive action. The person’s phone shows which agent is asking, what it wants to do, how much impact it has, and who it’s acting for. One tap approves or denies. Each answer is signed on the device and works for that one request only. Requests can also go to Slack, Teams or Jira.
Built on open standards, so you’re not locked in. It uses OpenID Connect, OAuth 2.1, SAML, SCIM, passkeys and AuthZEN. Any standard OIDC library works, and we have SDKs for JS/TS, Python, Go, PHP, Java and .NET. Moving in or out is mostly a configuration change.
Who it’s for
Product teams that want passwordless login without building it themselves. B2B SaaS companies whose enterprise customers ask for SSO and SCIM. Anyone putting AI agents into production who needs to show who approved what.
How it compares
Auth0, Clerk and Cognito handle human login well. LumoAuth gives agents the same treatment as people: each agent gets its own identity, a fixed list of what it can do, limits on steps, time and spend, short-lived tokens, an audit trail and a kill switch. One app on your phone covers both.
Try it
The Developer plan is free forever: 10,000 monthly users and 10 agents, no card needed - https://lumoauth.dev
What we’d love feedback on
How are you securing your agents and agentic applications? What kind of security primitives that you think you should have for building, deploying and running agents in production?
We’ll be here all day answering questions. Thanks for checking us out 🙏