AuthFI Agent

Identity at the kernel.
Zero code changes.

eBPF intercepts HTTP traffic at the kernel. Validates JWT, checks roles, enforces MFA per route. ~45us overhead. No sidecars, no proxies.

Available on Pro and above. See pricing

Agent dashboard

See every service, every node, every request decision in real-time.

console.authfi.app/agent
Active nodes
node-01
16 CPU / 32GB | 4 services
node-02
4 CPU / 8GB | 2 services
Live access log
10:30:05 allow alice GET /api/patients/123
10:30:06 allow alice POST /api/patients/123/notes
10:31:00 deny bob DELETE /api/patients/456
10:31:02 deny (no token) GET /api/patients

Policy enforcement at the kernel

Route-level rules

Match HTTP method + path. Protect specific endpoints.

GET /api/patients/*  roles: [doctor, nurse]
POST /api/patients/* roles: [doctor]

MFA per route

Sensitive ops require mfa_verified: true in the JWT.

DELETE /api/patients/:id
roles: [admin]  require_mfa: true

Group-based access

Require group membership for deployment endpoints.

POST /api/deploy/*
required_groups: [devops]

Monitor or enforce

Start in monitor mode, switch to enforce when ready.

mode: monitor  -> log only
mode: enforce  -> block unauthorized

WireGuard mesh networking

Peer-to-peer encrypted tunnels between nodes. Identity-aware routing. No VPN gateway bottleneck.

Encrypted tunnels

WireGuard between every node pair. ChaCha20-Poly1305. ~1ms overhead.

Identity routing

eBPF enforces identity on every packet traversing the mesh. No anonymous traffic.

Auto discovery

New nodes join the mesh automatically. Key exchange via AuthFI control plane.

vs. sidecars and proxies

FeatureAuthFIIstioEnvoy
Latency~45us~2ms~1ms
Code changesNoneNoneSidecar config
MFA per routeYes----
WireGuard meshBuilt-in----
Policy mgmtDashboard + APIYAMLYAML

Ready to get started?

Free for 5,000 monthly active users. No credit card required.