DOCSEARCHbyAlgolia
Submit Docs

Scalekit Documentation

website·Indexed 35 days ago

https://docs.scalekit.com/

Authentication, provider connections, and tool execution for AI agents and SaaS apps. Features include AgentKit for tool calling with pre-built connectors, SaaSKit for session management and Enterprise SSO, and support for Model Context Protocol (MCP) servers. Integrates with AI frameworks such as OpenAI, Anthropic, LangChain, CrewAI, and Vercel AI SDK.

Tokens
2.4M
Snippets
16.3K
Records
19.6K
Agent score
67%

What's inside Scalekit

  1. Overview of group-based role assignment

    Scalekit allows applications to map directory provider groups (e.g., an 'Engineering' group in a customer's directory) to specific application roles (e.g., an 'Editor' role in your app). Scalekit monitors role changes in the connected directories and notifies the application via webhooks in near real-time. This process is normalized across different directory providers, meaning the application receives consistent data regardless of the provider used. If a group is deleted from the directory, Scalekit removes that group from all members and recalculates roles based on remaining memberships.

  2. Overview of the Scalekit Tools client

    The scalekit.tools client provides raw tool schemas (including name, parameters, and connector), making it suitable for building custom agent adapters or integrating with LLM frameworks. For standard connect-and-execute flows, the Connected Accounts SDK is preferred. Methods in this client throw errors on 4xx/5xx responses.

  3. Overview of Vapi and Scalekit Virtual MCP Integration

    Integrating Vapi with Scalekit's Virtual MCP allows voice assistants to dynamically discover and use a scoped set of tools from a large catalog. Scalekit manages per-user OAuth authentication, token storage, and refresh, ensuring that the voice agent only accesses tools explicitly scoped for the user's role. This prevents token leakage to the LLM and keeps the context window manageable even when thousands of tools are available.

  4. Overview of Scalekit Node.js SDK capabilities

    The Scalekit Node.js SDK provides several core modules for AgentKit integration:

    • scalekit.actions: Used for managing connected end-user accounts and executing tools.
    • scalekit.tools: Provides raw tool definitions for building custom adapters.
    • Error handling: Provides typed exceptions (such as ScalekitNotFoundException) to handle API failures.

  5. Overview of Virtual MCP servers

    Virtual MCP servers provide a controlled, user-scoped endpoint for agents. Unlike standard MCP servers that expose all available tools, Virtual MCP servers allow you to define exactly which tools an agent can access and which user's credentials it uses. This solves three primary problems:

    1. Agent Overreach: Enforces least privilege by exposing only the tools explicitly allowed for a specific agent role.
    2. Token Bloat: Reduces context window overhead by limiting the number of tool definitions sent to the LLM.
    3. Per-user Credential Management: Ensures session isolation by using short-lived session tokens bound to specific users' connected accounts.

  6. Overview of Scalekit MCP Server

    The Scalekit Model Context Protocol (MCP) server allows AI assistants to interact with Scalekit's identity and access management platform using natural language queries. It provides secure, OAuth-protected access to manage environments, organizations, users, authentication connections, workspace members, OIDC setups, roles, scopes, and admin portal links.

  7. Overview of Enterprise SSO with Scalekit and Auth.js

    Scalekit provides a single OIDC-compliant authorization endpoint that acts as a gateway to various enterprise Identity Providers (IdPs) like Okta, Azure AD, and Google Workspace. By wiring Scalekit into Auth.js, developers can implement per-tenant SSO and handle protocol translation, certificate rotation, and attribute normalization without writing SAML code. Auth.js manages the session after the OIDC callback.

  8. Overview of migrating from Auth0 to Scalekit

    Migrating a B2B application from Auth0 to Scalekit involves moving user records, organization/tenant structures, and enterprise SSO connections. To avoid locking customers out, the recommended approach is an incremental cutover behind a feature flag. Instead of migrating password hashes, users are prompted to re-authenticate via SSO, social login, or passwordless authentication upon their next visit to Scalekit's hosted login.

  9. Overview of SCIM Directory Sync

    Use scalekit_client.directory to manage SCIM directory synchronization. This allows you to list providers, users, and groups provisioned from an Identity Provider (IdP). This functionality should be implemented after Single Sign-On (SSO) is already in place for the customer.

  10. Overview of Scalekit authentication interceptors

    Interceptors allow you to execute custom business logic at key trigger points during the authentication flow. Scalekit sends a POST request to your defined HTTPS endpoint and waits for an ALLOW or DENY response to determine if the process should continue.

    Available trigger points include:

    • Pre-signup: Before a user creates a new organization.
    • Pre-session creation: Before session tokens are issued for a user.
    • Pre-user invitation: Before an invitation is created or sent for a new organization member.
    • Pre-M2M token creation: Before issuing a machine-to-machine access token.

  11. Overview of Scalekit and Chargebee B2B billing integration

    This integration implements 'org-mode billing' for multi-tenant B2B SaaS apps. It maps the Scalekit organization ID (oid) from the access token to the Chargebee referenceId. This ensures that billing is handled per organization rather than per user, preventing duplicate customers and ensuring feature gates read accurate subscription data.

    Key architectural flows include:

    1. Provisioning: Creating a Chargebee customer when a Scalekit organization.created webhook fires.
    2. Authorization: Ensuring the session oid matches the billing referenceId before any Chargebee API call.
    3. Checkout: Creating a local subscription record with a future status before redirecting to Chargebee hosted checkout.
    4. Reconciliation: Updating local subscription status (active, in_trial, cancelled) via Chargebee webhooks.

  12. Overview of Scalekit Modular SSO

    Modular SSO is designed for applications that maintain their own user database and session management. It focuses solely on identity verification, offloading the complexity of SAML and OIDC protocol handling to Scalekit. After the identity provider verifies the user, Scalekit forwards the authentication response to the application, which then handles user record creation, session management, and access control.