HelixIAM by KubeDNA
EnglishENFrançaisFRNederlandsNL
Book a technical demo Demo

Platform

One identity core for people, workloads and AI agents.

Realms, policy, tokens, sessions and audit in one Kubernetes-native server. Pick the capabilities you need today; the rest is the same product.

Book a technical demoExplore the developer documentation
Reference architectureRuns in your cluster
HelixIAM reference architecture People, workloads and AI agents authenticate to HelixIAM, which runs inside your own infrastructure on Kubernetes with PostgreSQL. HelixIAM brokers European eIDs (DigiD, eHerkenning, eIDAS, and the EU Digital Identity Wallet in early access), keeps signing keys in your HSM over PKCS#11 or in Vault or OpenBao Transit, and issues tokens to applications, APIs and MCP tool servers. EUROPEAN eIDs · CONNECTORS INCLUDED DigiD eHerkenning eIDAS EUDI Wallet · early access brokered sign-in HELIXIAM IN YOUR KUBERNETES CLUSTER HelixIAM realms · policy · tokens · sessions · audit OpenID Connect · OAuth 2 SAML 2.0 Token exchange · RFC 8693 SCIM 2.0 Passkeys · MFA DPoP · PAR PostgreSQL · Redis (optional) · Helm chart, HA no message broker · no telemetry signing keys Key custody HSM · PKCS#11 Vault / OpenBao Transit Peopleemployees · customers · citizenspasskeys · MFA · SSO WorkloadsKubernetes pods · CI pipelineskeyless JWT exchange AI agentsassistants · MCP clientson-behalf-of · narrowed scope Applicationsweb, SaaS and existing appsOIDC · SAML 2.0 APIsresource serversaudience-restricted tokens MCP tool serversAI tool endpointsRFC 9728 tokens HelixIAM reference architecture People, workloads and AI agents authenticate to HelixIAM, which runs inside your own infrastructure on Kubernetes with PostgreSQL. HelixIAM brokers European eIDs (DigiD, eHerkenning, eIDAS, and the EU Digital Identity Wallet in early access), keeps signing keys in your HSM over PKCS#11 or in Vault or OpenBao Transit, and issues tokens to applications, APIs and MCP tool servers. EUROPEAN eIDs · CONNECTORS DigiD eHerkenning eIDAS EUDI Wallet · early access PeoplepasskeysMFA · SSO WorkloadsK8s · CIkeyless AI agentson-behalf-ofnarrowed IN YOUR CLUSTER HelixIAM realms · tokens · audit OpenID Connect · OAuth 2 SAML 2.0 Token exchange · RFC 8693 SCIM 2.0 Passkeys · MFA DPoP · PAR Key custody HSM PKCS#11 Vault / OpenBao Transit tokens AppsOIDC · SAML APIsaudience-restricted MCP toolsRFC 9728
Reference architecture. HelixIAM runs in your Kubernetes cluster with PostgreSQL. Signing keys stay in your HSM or in Vault / OpenBao. European eID connectors are included; you connect DigiD or eHerkenning under your own agreement. Your applications, APIs and agents can run in the same infrastructure.

Capabilities

Explore the platform.

Authentication & MFA

Passkeys, authenticator-app MFA, magic link and adaptive step-up.

Authentication & MFA

SSO & federation

OpenID Connect, OAuth 2 and SAML 2.0, LDAP/AD, brokering and SCIM.

SSO & federation

AI agents

Agent identities with owners and a lifecycle, delegation that only narrows, suspension.

AI agents

Workload identity

Keyless identity for Kubernetes and CI: no long-lived secrets.

Workload identity

European eIDs

DigiD, eHerkenning and eIDAS connectors; EU wallet sign-in Early access.

European eIDs

Security & key custody

Per-tenant keys in your HSM or Vault, hardened tokens, audit to your SIEM.

Security & key custody

Admin API & automation

Console, documented REST API, Terraform, SCIM and Keycloak import.

Admin API & automation

Admin console

Everything in the console is in the API.

The admin console covers realms, applications, users, roles, sessions, flows, keys and events. Everything in it is available through a documented admin REST API.

HelixIAM admin console, AI agents screen: agent counts by status, an owner review flagging an agent whose owner has left, and a table of agents with owner, status, authentication method and bound application. HelixIAM admin console, AI agents screen: agent counts by status, an owner review flagging an agent whose owner has left, and a table of agents with owner, status, authentication method and bound application.
HelixIAM console · AI agentsIllustrative data

See the platform on a running system.

A technical demo mapped to your use case, with the engineers who build HelixIAM.

Book a technical demoRequest an architecture consultation