Jared Hanson is co-founder and chief technology officer of Keycard and the creator of Passport.js, the open-source Node.js authentication framework. His work addresses a defining security problem for autonomous software: how agents can act across applications and organizations without acquiring unrestricted access.
Hanson designed Passport.js around interchangeable authentication strategies, allowing developers to incorporate passwords, social login, OAuth, OpenID, and enterprise identity providers without surrendering control of their application architecture. He also created OAuth2orize, a toolkit for implementing OAuth 2.0 authorization servers in Node.js.
He subsequently served as chief architect at Auth0 and held a senior technical leadership position at Okta. His writing on identity architecture explored how authentication, OpenID Connect, and protected APIs fit together as applications mature.
Hanson co-founded Keycard with Ian Livingstone and Matthew Creager to develop identity and access infrastructure for agents. The company launched publicly in 2025 with $38 million in seed and Series A financing. Hanson describes the challenge as managing relationships among people, agents, and applications while giving security teams visibility into what autonomous systems can access, a focus reflected in his public account of Keycard’s identity infrastructure.
His approach to securing autonomous agents
- Delegated access without permanent secrets. Hanson favors short-lived OAuth access tokens over broadly scoped, long-lived API keys. Authorization servers can manage consent, issue bounded credentials, and rotate access while preserving useful connections between agents and external services.
- Separate MCP tools from authorization servers. He argues that Model Context Protocol servers should validate tokens as OAuth resource servers, leaving authentication, consent, and issuance to dedicated authorization infrastructure. This separation prevents each tool from having to recreate an identity platform and improves interoperability.
- Verifiable agent identity. Hanson challenges dynamic client registration when an unknown agent can obtain credentials without establishing trust. He advocates recognizable URLs, public-key infrastructure, and signed assertions for agents requiring authentication, while avoiding unnecessary registration for public clients.
- Transaction-specific authorization and chain of custody. Agents handling payments or sensitive infrastructure need permissions tied to particular transactions, amounts, or budgets. Token exchange and cross-domain identity chaining can preserve accountability as authority moves between users, agents, tools, and downstream APIs.
- Consent and attestation beyond the browser. Background agents may require additional consent after users step away, while edge-deployed agents may need to attest to their software and data destinations. Hanson extends these concerns to voice, video, and agent-to-agent interactions in his AI Engineer World’s Fair presentation on securing agents with OAuth.
