FOR THE JOBS NOBODY SIGNS IN TO
Automations without shared secrets.
Give each scheduled job and integration its own identity in your directory, with a certificate or a federated credential instead of a password-style secret. Know which job did what, and revoke one without touching the rest.
New to OpenX? Key terms →
ONE JOB · ITS OWN IDENTITY
- Credential
- Federated, or a public certificate you supply
- Access
- The access configurations you pick for it
- Token
- Its own lifetime, never past the directory token
- Stamp
- Its name on what it does
- Revoke
- Credential removed, cards gone, name retired
Every job has a name.
FROM "CREATE IT FOR ME" TO REVOKE
Made for you, in your own directory.
Create it for me
Pick the job's access, pick a credential, and OpenX makes the identity in your own Entra or B2C directory.
No password-style secrets
A federated credential or a public certificate on Entra; a certificate on B2C. A private key is refused.
Or bring your own
Already have an app registration for the job? Enter its client id and OpenX creates nothing.
Tokens on your terms
A job calls with its own directory token, or swaps it for a short OpenX token. Set each job's token lifetime.
Rights checked on every call
The swapped token carries no rights of its own. Each call is checked against your API Manager rules, using the rights the job's access cards give.
Change it later, or revoke it
Change a job's access cards after it is made, with a fresh sign-in when it gains a right. Revoking removes the credential OpenX made, removes the job's cards, and retires its name.
IF ONE SHARED ACCOUNT RUNS EVERY JOB
For teams with more jobs than people.
Integration owners
Say which sync uploaded a file or sent a mail, by name.
IT and security leads
Fewer long-lived secrets, and each job revoked on its own.
Regulated teams
A named machine actor on what each job does.
NEXT TO WORKLOAD IDENTITY TOOLS
Not a new idea. Made with the job, in your Azure.
Identities without stored secrets, instant revoke and token lifetimes exist in good workload identity tools. OpenX's difference is where it happens: in your own directory, in the same window that grants the job its rights.
- The job, its credential and its rights are set up together.
- Adding a right or changing a credential needs a fresh sign-in first.
- An AI connected over MCP can propose a job identity, but only a person accepts it, in App Identity.
JOBS TEAMS RUN
Every integration, on its own name.
A LIMS sync
- 01Create an identity for the sync job.
- 02Give it access to the lab routes only.
- 03Its uploads name the job.
A partner integration
- 01The partner's job gets its own identity.
- 02Your API Manager rules limit what it reaches.
- 03When the contract ends, revoke it.
An AI drafts it
- 01An agent over MCP proposes a job identity.
- 02A person reviews it in App Identity.
- 03Only that person can accept it.
JOBS THAT NEED A NAME
Machine actors, named.
LIFE SCIENCES
A LIMS sync uploads results under its own identity.
MANUFACTURING
A historian export and an MES integration, each revoked on its own.
ENERGY AND BUILDINGS
A utility-feed import with its own token lifetime.
Give every job a name.
Set up your directory in App Identity, then create your first job identity.
MORE OF OPENX
AI governance →
Over MCP, AI proposes and a person accepts. Only a person deploys.
OpenX MCP Server →
A few tools let any MCP-capable AI read your workspace and propose changes to it.
API Manager →
Your workspace is already an API. Decide who may call it and what each caller reaches.
Warm queries →
Save a question over live data and serve the answer to dashboards, apps and AI.
Provenance →
A record you can prove, kept in your own cloud, with corrections and signatures.
Your cloud →
Connect your Azure, build the landing zone, and the rest of OpenX runs inside it.
Databases →
A Cosmos DB store in your subscription, with a governed API for each container.
App Identity →
Your own sign-in directory, identities for your jobs, and access in one window.
Licenses →
Sell what you build on your own Stripe, and turn a subscription into a plan's rights.
IoT →
IoT Hub and Data Explorer in your Azure, feeding queries, APIs and AI.
Communications →
Send mail through your own relay, with the password in your vault and sends on record.
App building →
Data, sign-in, access, an API and billing: your app's backend, already there.