Customer-facing agents
In short: agents that act for your customers need customer identity, not workforce SSO. Auth0 for AI Agents offers CIBA asynchronous authorization, generally available since November 2025. Descope offers short-lived scoped tokens and MCP authorization. Ask the customer to approve sensitive actions on their own device.
What does Customer-facing agents already give you for agent identity?
- Auth0 for AI Agents asynchronous authorization (CIBA) GA on 19 November 2025. Auth0 for AI Agents generally available, read 2026-11-03
Where is the gap?
Workforce identity tools are not built for millions of customers. The approval must reach the customer, not an employee.
Which key results usually apply?
Which products fit?
| Product | Fits when |
|---|---|
| Descope | You build MCP servers or apps and need MCP authorization, CIMD and PKCE handled. |
| Okta for AI Agents | Most of your people sign in through Okta. |
Questions buyers ask
What is CIBA for customers?
The agent asks, and the customer approves on their own device before the action runs.
When did Auth0 CIBA for agents ship?
Auth0 for AI Agents asynchronous authorization (CIBA) became generally available on 19 November 2025.
Is there a free option?
Descope's Free Forever tier includes its agentic identity hub.