# SealGate

> An API and browser SDK for adding passkeys (FIDO2 / WebAuthn, biometrics) to your existing login.
> SealGate handles registration, authentication, revocation and recovery. Your users' data and your login page stay with you. Developed and operated in Japan.
> Operated by SHANNON LIMITED LIABILITY COMPANY https://shannon.co.jp/

- Website: https://sealgate.jp/en (Japanese: https://sealgate.jp/)
- API reference: https://sealgate.jp/en/docs (Japanese: https://sealgate.jp/docs)
- Blog (passkeys, account security, rollout): https://sealgate.jp/en/blog (Japanese: https://sealgate.jp/blog). RSS: https://sealgate.jp/en/blog/feed.xml
- Pricing: https://sealgate.jp/en#pricing (stepped by the MAU of each billing period: up to 1,000 is $0 / up to 10,000 is $65 / up to 100,000 is $350 / above 100,000 MAU the price stays at $350, and Enterprise plans are available on request; excluding tax. Yen prices: https://sealgate.jp/#pricing)
- Sign up (self-serve): https://app.sealgate.jp/signup (email address / Google / GitHub)
- Dashboard: https://app.sealgate.jp/login
- Contact: https://sealgate.jp/en/contact
- API base URL: https://api.sealgate.jp/v1
- MCP server (for AI agents): https://api.sealgate.jp/v1/mcp
- Browser SDK: https://sealgate.jp/sdk/v1.js (npm: sealgate-browser)
- Server SDKs: Node.js (npm: sealgate-server), Go (github.com/shannonllc/sealgate-go), PHP (Packagist: shannonllc/sealgate). Python is coming soon
- Agent skill (integration steps): https://sealgate.jp/skill/SKILL.md
- Claude Code plugin: https://sealgate.jp/plugin/marketplace.json

## Using MCP (for AI agents)

Connect to `https://api.sealgate.jp/v1/mcp` over Streamable HTTP. Authentication is OAuth 2.1 (dynamic client registration, PKCE S256).
When you add the URL to your client, the browser opens the dashboard login (email, Google, GitHub, passkey) and a consent screen. The client then acts as the account that allowed access, with the same role as in the dashboard (viewer / developer / admin / owner). New users can sign up from that login screen.
Getting started: list_organizations (or create_organization if there is none), then get an app_id from list_projects / list_environments.
Environment tools (app_id): get_app / update_app / set_resident_key / get_webhook_portal / create_api_key / list_users / list_credentials / rename_credential / revoke_credential / revoke_user / delete_user / issue_recovery_token / list_audit / get_stats.
Organization tools (organization_id): create_app / list_api_keys / revoke_api_key (runs with confirm: true) / get_account / create_checkout (URL for adding a card) / get_billing_portal / list_members / invite_member.
Allowed apps can be revoked under Connected apps in the dashboard's account settings.
The MCP accepts only this login. API keys are for calling the REST API (/v1) from your server.
Create your account in the dashboard at https://app.sealgate.jp/signup.

## How it works (summary)

1. Sign up with an email address, Google or GitHub (later logins can also use a passkey), create a project in the dashboard (Live and Test environments, each with its own rp_id and allowed origins), and issue an API key per environment (sk_live_ for Live, sk_test_ for Test; Test environment users are not billed)
2. Pass your server's URLs to the browser SDK as optionsUrl / verifyUrl
3. Your server relays the JSON sent by the SDK to `POST /v1/register|login/options|verify` with the API key
4. Issue your own session with the external_id returned by login/verify
5. For additional passkeys of a logged-in user, your server adds `signed_in: true` to `POST /v1/register/options`
6. A user who lost their device registers again with a token from `POST /v1/recovery/start`, after you verify their identity
7. Rename a device with `PATCH /v1/credentials/{id}`. Delete a user (removes passkeys and display name, anonymizes the audit log) with `DELETE /v1/users/{external_id}`. To only revoke passkeys, use `POST /v1/users/{external_id}/revoke`
8. Autofill (conditional UI) is `sg.login({}, { mediation: 'conditional' })` in the SDK. The residentKey requested at registration and the user verification (biometrics or a PIN) are app settings (resident_key and user_verification in `PATCH /v1/apps/{id}`)