Zalando Incubator Opens agentic-identity-broker for OAuth2 Delegation in AI Agents

• Zalando Incubator released agentic-identity-broker, an open-source tool for managing OAuth2 delegation and scoped access for AI agents.
• The system prevents direct credential sharing by using a secure token vault and fail-closed architecture with cryptographic verification.
• It centralizes token exchange to allow agents to interact with hundreds of MCP servers through a single channel, reducing the OAuth2.1 implementation burden on server developers.
• Currently in active development and used in Zalando's internal production environment, the project is written in Go and licensed under MIT.

Architecture and Security

• Implements on-behalf-of flows and delegation chains to bridge different OAuth2 infrastructures.
• Features sensitive value redaction, command injection prevention, and structured JSON audit logging for compliance.
• Provides a modern consent management UI that adheres to design system standards.

Use Cases and Integration

• Supports internal MCP servers by centralizing token vaulting and conversion, allowing developers to focus on tool provision.
• Enables SaaS providers to maintain audit trails for agent usage regardless of the specific agent type.
• Facilitates hosted agents to use arbitrary MCP servers with a single user token, front-loading token acquisition via a portal.