---
"@context": https://schema.org
"@type": TechArticle
"@id": https://www.twilio.com/docs/agent-identity/overview#article
headline: Overview
description: Turn your app into an OAuth 2.1 authorization server for AI agents. Issue scoped, revocable access tokens and require human approval.
url: https://www.twilio.com/docs/agent-identity/overview
inLanguage: en
dateModified: 2026-09-18T12:02:39.000Z
author:
  "@type": Organization
  name: Twilio Developer Education Team
publisher:
  "@type": Organization
  name: Twilio
---

# Overview

> \[!IMPORTANT]
>
> Agent Identity is available as a Private Beta product, and the information
> contained in this document is subject to change. You acknowledge and agree
> that your use of Agent Identity is subject to the terms of the [Services in
> Private
> Beta](https://www.twilio.com/en-us/legal/service-country-specific-terms/private-beta).
> Some features are not yet implemented and others may change before the
> product is declared as Generally Available. Private Beta products are not
> covered by the Twilio Support Terms or Twilio Service Level Agreement.

> \[!WARNING]
>
> Agent Identity is not a HIPAA Eligible Service or PCI compliant and should
> not be enabled in workflows subject to HIPAA or PCI.

Agent Identity turns your application into an OAuth 2.1 and OpenID Connect compliant authorization server. Your users can grant an AI agent scoped, revocable access to their account, and you can require out-of-band human-in-the-loop approval for sensitive actions over a Twilio channel such as SMS or RCS before the agent proceeds.

## What you can do with Agent Identity

* **Issue standards-based access tokens** to AI agents that act on behalf of your users, so your APIs can authorize agent requests with standard JWT validation.
* **Keep your current authentication system** — you identify the logged-in user, and Agent Identity handles the OAuth flow and consent management.
* **Serve users a consent screen from your own domain**, giving them the ability to grant fine-grained access to an agent.
* **Track and revoke agent access** — see which agents each user has authorized and what they can do, and revoke that access at any time.
* **Require human approval for high-risk actions** using Client-Initiated Backchannel Authentication (CIBA), delivered over Twilio channels.
* **Securely authenticate agents** using the latest Model Context Protocol (MCP) standard.

## How the pieces fit together

At a high level, an agent gets access in five steps:

1. An agent redirects the user to your authorization endpoint to start an OAuth flow.
2. If the user isn't already signed in, Agent Identity redirects them into your authentication system through the Trusted Auth Token flow. Your system authenticates the user and redirects them back to Agent Identity.
3. Agent Identity shows the user a consent screen describing who the agent is and what access it is requesting.
4. When the user approves, Agent Identity returns an authorization code to the agent.
5. The agent exchanges the code for an access token and uses that token to call your APIs.

To understand each step in detail, see [How Agent Identity works](/docs/agent-identity/concepts/how-it-works).

## Where to go next

* New to the product? Read [How Agent Identity works](/docs/agent-identity/concepts/how-it-works).
* Ready to build? Start with [Set up Agent Identity](/docs/agent-identity/setup).
* Integrating your login system? See [Issue Trusted Auth Tokens](/docs/agent-identity/concepts/trusted-auth-tokens).
* Adding permissions? See [Authorize agents with scopes and Rich Authorization Requests](/docs/agent-identity/concepts/scopes-and-rar).
* Adding human approval? See [Require human approval with CIBA](/docs/agent-identity/concepts/ciba).