Identity rooted in a person
Each agent acts for a verified employee, with a new credential for every call.
Authentication for AI agents and the people behind them.
Hawcx roots every AI agent in a verified person and checks each tool call before it runs. Your customers and employees sign in without a password.
In a chat, Dana asks her billing agent to refund a duplicate $180 charge. Hawcx checks the request: its identity is rooted in Dana, it is within her $1,000 limit, and a credential is issued for that call only, so it is allowed and recorded. She then asks for the $2,400 refund. It is over her limit, so Hawcx holds it for her; she approves it in the chat, and it runs, on the record. Dana signs in on her phone with a biometric.
How Hawcx works
Two products,
one identity layer.
AI agent authentication
Every agent action is checked against the person it works for, before it runs.
Passwordless authentication
Phishing-resistant sign-in with a key that never leaves the device.
In her deploy agent’s chat, Priya asks it to ship the checkout fix to production. The agent deploys to staging first: Hawcx checks the call against Priya’s ceiling, confirms the agent acts for her, and allows it. Then it asks to deploy to production: that needs a person, so Hawcx holds it for Priya. She approves in the chat, the deploy is allowed, and a signed receipt is recorded.
Priya signs in to Acme with her email. Hawcx checks that her device holds her key, she confirms it’s her with a biometric, and she is signed in with no password. A lookalike site can’t use her key, and there is no password to hand over.
AI agent authentication
Every agent tied to a person.
Every call checked.
Explore AI agent authentication
Hawcx gives each AI agent an identity rooted in the employee it works for, checks every tool call against that person’s ceiling before it runs, and keeps a record of every attempt.
Checked against a ceiling
Every tool call is allowed, held, rejected or denied before it runs.
Approvals
Sensitive actions wait for a named person.
Audit
Every attempt is recorded, with the person behind it.
Stop any agent
Stop one agent, or every agent a person owns, from one place.
Passwordless authentication
Sign-in without passwords.
For customers and employees.
Explore passwordless authentication
People sign in with a biometric or device PIN, using a key that never leaves their device. There’s nothing to phish, reset or leak.
Phishing-resistant
A key only works on the site it was made for. Lookalike sites get nothing.
Drop-in SDKs
Six SDKs and a WordPress plugin, for the apps you already have.
Device-bound keys
Keys are made on the device and never leave it.
Workforce SSO
Passwordless SAML sign-in for your employees’ apps.
Nothing to reset
No passwords to reuse, reset or leak.
Enterprise
Built for your security review
Everything your reviewers need to approve Hawcx, and a team that stays with you after launch.
Talk to salesSecurity review
The SOC 2 Type II report, architecture and data-flow documents your reviewers ask for.
Deployment
Run Hawcx in your cloud or ours, next to the identity provider you already use.
Ongoing support
A named technical contact, with response times written into your order form.