# 1Profile > 1Profile is an OAuth 2.0 and OpenID Connect identity provider: hosted sign-in, passkeys, identity verification (KYC), enterprise SSO and SCIM, a REST API and an MCP server for AI agents. Credit-based pricing, API calls free. The full reference (every API endpoint, MCP tool, price, FAQ and blog post, as Markdown) is at [/llms-full.txt](/llms-full.txt). 1Profile is a unified digital identity management platform that brings together personal profiles, AI agents, password vaults, single sign-on, and identity verification into one privacy-first system. The platform is built around a user-controlled digital identity that replaces fragmented online profiles with a single, encrypted, portable identity. Key capabilities: - Profile and public directory: a structured profile with version history, shareable publicly or per API scope. - AI personas and AI agent: personas that chat in your style using your knowledge base, and an in-app agent that acts on your account. - Knowledge base, content, automations and voice clones: documents that ground personas, articles and posts, AI workflows triggered manually or by webhook, and speech in your cloned voice. - Password vault: entries encrypted in the browser with a master password; the server never sees passwords. - Sign in with 1Profile: a full OAuth 2.0 and OpenID Connect provider — authorization code with PKCE, refresh-token rotation, RS256 id_tokens, discovery at https://lluoavnspwejosiuqymg.supabase.co/functions/v1/oauth/.well-known/openid-configuration, dynamic client registration at POST /register, the scopes openid, profile, email, organizations, wallet and mcp, and hosted, app-branded sign-in portals at /portal/{slug}. - Two-factor: TOTP codes from any authenticator app (Google Authenticator, Authy, Duo Mobile, 1Password) with backup codes. Organizations can connect their own Duo account (Organization → Security → Duo Push) to require Duo Push for 1Profile sign-in, the Password Vault, and Sign in with 1Profile; when required for app sign-in, GET /oauth/authorize returns 403 {"error":"duo_required"} until the member approves a push on the consent page. - Client SDKs: @1profile/js (framework-free browser client), @1profile/react (provider, hooks and drop-in sign-in components) and @1profile/node (code exchange, id_token and webhook verification, and the management API). - 1Profile Verify: identity verification for third-party apps (government ID and selfie via Stripe Identity, 1Profile's own in-house KYC, or Plaid; templates can also require only a phone-number check), with verified people sharing their result with the next app in one step and revoking it anytime. - Developer API and MCP server: every feature above is available through the REST API with scoped API keys, and through an MCP server for AI agents. API calls are free; credits pay for AI actions (persona chat, automation runs, speech, agent messages), each completed sign-in through your app, and identity verifications. ## Pages - [Home](/): Product overview, key features, pricing preview, and platform statistics. - [Features](/features): Detailed breakdown of platform capabilities including AI personas, password vault, SSO, identity verification, and API access. - [Pricing](/pricing): Credits-based pricing tiers and subscription plans. - [Security](/security): Security architecture, encryption details, and compliance information. - [Integrations](/integrations): Supported third-party integrations and connection options. - [About](/about): Company story, team, and mission. - [Contact](/contact): Contact form and company information. - [Support](/support): Help center, documentation links, and support channels. ## Documentation - [API Docs](/api-docs): REST API reference, base URL https://lluoavnspwejosiuqymg.supabase.co/functions/v1/profile-api, for users (partner-app user lookup and programmatic creation), profiles, personas, knowledge, content, automations, voice clones, connections, vault metadata, credits, usage, organizations, webhooks, OAuth apps (fully configurable over the API: create/update/delete apps, rotate secrets, hosted portal branding, bring-your-own provider credentials, SAML enterprise SSO connections, SCIM provisioning tokens, your app's own users with bans and grant revocation, its sign-in event log, and its organizations with members, invites and roles), identity verification (Verify) and the in-house KYC service; plus scopes, credits, webhook signatures, Sign in with 1Profile and error codes. - [API Playground](/api-playground): Run API requests with your key in the browser. - [MCP](/mcp): The MCP server for AI agents: every API capability as a tool, authenticated with an x-api-key header or with Sign in with 1Profile (an OAuth token carrying the mcp scope), and advertising RFC 9728 protected-resource metadata so clients discover the authorization server themselves. - [Changelog](/changelog): Product updates, feature releases, and version history. - [Status](/status): Platform uptime, incident history, and service status. ## Company - [Privacy Policy](/privacy-policy): Data handling, user rights, and privacy commitments. - [Terms of Service](/terms): Account, acceptable use, and SMS verification code terms. - [Data Request](/data-request): GDPR and CCPA data subject request portal. ## Blog - [Blog Home](/blog): All articles on digital identity, security, engineering, and product updates. - [What Is Digital Identity?](/blog/what-is-digital-identity): Comprehensive guide to digital identity management and the shift from fragmented profiles to unified identity. - [Introducing 1Profile Credits: A New Way to Scale Your Identity Infrastructure](/blog/introducing-1profile-credits): The credits-based pricing model and why usage should not cost the same every month. - [How We Built End-to-End Encryption for the Password Vault](/blog/end-to-end-encryption-password-vault): The cryptographic architecture that keeps every vault operation in the browser. - [Future of Digital Identity: Predictions for 2026](/blog/future-of-digital-identity-2026): Industry trends including decentralized identity, AI-powered verification, and passkeys. - [Best Practices for Implementing SSO in Your Organization](/blog/sso-implementation-best-practices): A guide to rolling single sign-on out across a company's applications. - [Why We Open-Sourced Our Client SDKs](/blog/open-sourced-client-sdks): The MIT-licensed @1profile/js, @1profile/react and @1profile/node libraries, and the case for transparency. - [Announcing SOC 2 Type II Compliance](/blog/soc2-type-ii-compliance): What the certification audits, and what it means for customers. - [The Passkey Problem Nobody Talks About in 2026](/blog/passkey-problem-2026): Why passkeys create lock-in, recovery nightmares, and what to do instead. - [How AI Agents Are Quietly Replacing Your SSO Admin](/blog/ai-agents-replacing-sso-admin): AI identity automation for access management and compliance. - [Your Passwords Are Worth $1,200 on the Dark Web](/blog/passwords-dark-web-value): Credential value, dark web risk, and how an encrypted vault protects you. - [Your Identity Was Probably Leaked This Month](/blog/identity-leak-september-2026): How to check breach exposure in 60 seconds and the one-hour response plan. - [AI Agents Are Logging In As You Right Now](/blog/ai-agents-logging-in-as-you): Scoped agent credentials, delegation, audit trails, and MCP authentication. - [The SSO Setting That Quietly Lets Ex-Employees Back In](/blog/sso-misconfiguration-audit): Session and refresh-token lifetimes, offboarding checklist, per-app revocation. - [Identity Verification Just Got Stricter](/blog/identity-verification-rules-2026): Verification levels, costs, failure-path design, and reusable verified identity. - [Your Face Is a Password Now—and AI Just Learned How to Steal It](/blog/deepfake-identity-crisis-2026): Deepfake identity attacks, layered liveness checks, and safer reusable verification. - [Your Enterprise Login Is One Acquisition Away From Total Chaos](/blog/enterprise-sso-login-chaos): Multi-tenant SAML, domain routing, SCIM, and enterprise access controls. - [That Six-Digit Text Code Won't Save You Anymore](/blog/sms-codes-are-dying): SIM swaps, phishing relays, and moving from SMS codes to passkeys. - [You Just Handed Your AI Assistant the Keys to Your Life](/blog/ai-agents-holding-your-keys): Least-privilege, scoped, rotatable access for AI agents. - [Hackers Are Already Preparing for Your Holiday Shopping](/blog/holiday-account-takeover-season): Credential stuffing, account takeover, and a pre-holiday security checklist.