QuoxCORE components · identity & access

Don’t build your own identity layer.

Accounts, organisations, roles and credentials for a platform where the users are not all human. Months of undifferentiated work, and it ships in QuoxCORE on day one.

See what ships Try the live demo

Included in QuoxCOREFree, self-hosted, nothing to buy.

Build it yourself and you are signing up for

Session auth for humanssign in, MFA, password reset, revocation, rate limits on every one of them
Machine identity for agentsAPI keys and service accounts you can scope, rotate and revoke
Multi-tenancy that holdsorganisations, divisions, departments and teams, with every query scoped to them
A role model enforced everywherenot just on the pages you remembered
A secret store agents can use but never readper-org encryption, leases, audit on every touch

Or install QuoxCORE. All of it is already there.

In plain words

What it is, where it lives, when to reach for it

What is it: The identity layer of QuoxCORE: accounts, organisations, teams, roles and connected credentials for people and agents.
Where do I use it: In the dashboard organisation pages, and in your terminal through quox org, quox team and quox vault.
When would I use it: Every time a person signs in, an agent acts, or a connected service needs a credential.
How do I use it: You do not add it; it is on from install. Run quox whoami to see your identity, org and role.

QuoxCORE is the free, self-hosted platform underneath this. What is QuoxCORE

auth

One identity for humans and machines.

People sign in with sessions, MFA and password reset. Agents authenticate with API keys and service accounts you scope and revoke. Both resolve to the same identity model, so every action traces to a who, human or not.

How do I use itquox loginDashboard: sign inthen quox whoami shows who you are, in which organisation, with which role.

$ quox whoami
  User      Component Tour
  Email     [email protected]
  Org       Meridian Ops (meridian-1788993466)
  Role      owner

Real output · demo organisation · captured 2026-09-09

organisations & teams

Multi-tenant from the first user.

Organisations own everything: agents, workflows, memories, credentials, evidence. Divisions, departments and teams nest under them, and every resource carries its scope. A second organisation is a clean room, not a filter.

How do I use itquox org createDashboard: Organisationsquox org switch moves your session; quox team list shows the tree you are in.

Honest noteFound while proving this page: quox team create cannot set a slug and fails against the API. Filed as quox#525 on 2026-09-09; create teams in the dashboard until it lands.

The organisations grid in the QuoxCORE dashboard: each organisation a card with its own members, agents and evidence

rbac

Deny by default, scoped to the tree.

Every route and tool call passes a permission gate before it runs; a route the gate does not know answers 401 rather than defaulting open. Roles apply at organisation, division, department and team depth, and scopes are readable, so you can see exactly what a grant covers.

How do I use itquox scope listDashboard: Teams & rolesgrants are managed through quox org and quox team; scopes are the read-only view.

$ quox scope list
 Name               Type   Depth (0=org, 3=team)
 Meridian Ops       org    0
 Meridian Ops Team  team   3

Real output · demo organisation · captured 2026-09-09

integrations

Credentials agents can use, never read.

External services connect through the vault. A credential is written once, encrypted with per-organisation keys, and agents reference it by name: the value never appears in a prompt, a log or a transcript. Usage lands in the audit trail like every other governed action.

How do I use itquox vaultDashboard: Vaultthe old quox integration verbs remain as an alias, so nothing you scripted breaks.

The QuoxVault dashboard: encrypted credentials with per-organisation keys, leases and audit

Where it sits

The bottom-left of the stack.

Bundled with QuoxCORE; identity is not an add-on. Everything above it, plugins, the SDK and your own code, inherits it without writing it.

if that’s not enough ...your code goes hereyour plugin can use everything underneath

you build this

Auth service docs/Organisations docs/Integrations docs/QuoxVault/QuoxCORE

Ready when you are

Ship your feature, not your auth.

Identity and access ship in the box with QuoxCORE: no extra licence, no extra install.

See the platform Try the live demo