4 posts tagged with "2026"

ThunderID 1.0 is generally available today. This is our first GA release. We built ThunderID from scratch, in Go, because open source IAM was designed for a world where humans were the only intelligent actors, quantum computing was a research topic, and decentralized identity was still a spec draft. That world is gone. ThunderID handles authentication, authorization, and identity for humans, AI agents, and machines, and it secures applications, APIs, Model Context Protocol (MCP) servers, and wallets.

Three ThunderID team members presented at recent MCP Dev Summit events organized by the Agentic AI Foundation. Ayesha spoke at both events, and Hasini and Sahan presented together at one of them.

• Ambient Identity: Just-in-Time Authorization Patterns for the Model Context Protocol
• Who's Calling? Bringing Identity to the MCP Host
• Your AI Chatbot Just Exposed Your CEO's Salary to an Intern

We picked these topics because they're the same problem viewed from three different altitudes. MCP still doesn't have a clean answer for who an agent is acting as when it makes a call, whether that agent is unattended, orchestrated by a host, or acting inside an enterprise on a user's behalf. That's the thread running through all three talks, and it's why we're covering them together instead of as three separate recaps.

ThunderID is an open source IAM stack built from scratch for AI agents, post-quantum security, and decentralized identity, with a lightweight Go runtime and GitOps support. One of its four foundational pillars is decentralized identity: digital wallets, verifiable credentials, and DIDs.

An early priority for us is closing the gap between application development and existing decentralized identity infrastructure. Developers shouldn't have to become DID or verifiable credential specialists to use them, especially those building citizen-facing or public-sector applications. Adding decentralized identity capabilities to an app should be as straightforward as adding any other identity feature, so teams can build directly on that infrastructure instead of around it.

CitizenVerify is a demo application built for the EUDI Wallet Hackathon 2026. We entered as team Ctrl Alt Verify and won the Public Sector Track. CitizenVerify enables citizens to verify the authority of public officials using verifiable credentials and digital wallets, with ThunderID powering both credential issuance and verification end to end.

Open source IAM has shaped identity infrastructure for decades. It gave real alternatives to proprietary software, made identity tooling free and accessible to anyone. That work mattered, and it still does.

Most open source IAM projects started more than a decade ago. Humans were the only intelligent actors in a system, and machines followed instructions without reasoning about them. Quantum computing was a research topic, distributed identity infrastructure was still emerging, and deployment practices like GitOps did not exist yet. The design decisions made then reflected that world well.

That world has changed. AI agents are running in production, holding credentials, calling APIs, and acting on behalf of users and services. Cyberattacks such as harvest-now-decrypt-later and trust-now-forge-later are real. Digital wallet ecosystems are maturing, and modern teams use containerized deployments and practice GitOps. Open source IAM hasn't caught up, and that gap is real. ThunderID is our attempt to close it: a new open source IAM stack built from scratch, designed for the identity problems of this decade and the one that follows.