PropelAuth MCP. Manage B2B identity lifecycle via conversation.

PropelAuth handles your entire B2B identity lifecycle so you don't have to touch a dashboard. Your agent treats user and organization management like simple natural language commands. You can build out complex, multi-tenant systems—creating new client organizations with create_org, querying multiple tenants using query_orgs, or updating general organizational details via update_org.

You'll also get full details on a specific tenant using get_org and you can permanently wipe an organization and all its data with delete_org.

When it comes to users, your agent manages the entire identity lifecycle. You can create new accounts for clients with create_user, or find existing people quickly by their email address with get_user_by_email, or just by username using get_user_by_username. If a user needs an update—say, changing their name via update_user or switching their primary email with update_user_email—you'll handle it.

For security, you can manually change passwords with update_user_password, reset the password and clear credentials using clear_user_password, and block an account entirely by calling disable_user; don't forget that you can restore access anytime with enable_user. You also have tools to manage membership: you can send out invites and add a user roster directly with invite_user_to_org, or remove them from a tenant using remove_user_from_org.

If someone needs to leave, your agent handles it by calling delete_user or delete_api_key.

For enterprise setups, you've got full control over federation. You can configure OpenID Connect (OIDC) and SAML identity providers by setting the required metadata using set_oidc_idp_metadata or set_saml_idp_metadata. To get a client connected via SAML SSO, your agent generates the exact setup link with create_saml_connection_link, and you can activate the connection globally using allow_saml or flip an existing config to 'live' status with go_live_saml.

You can also migrate existing users from other systems into PropelAuth's management scope via migrate_user, and if a user needs immediate lockout, your agent invalidates all their active sessions using logout_all_user_sessions.

API key governance is handled programmatically. Your agent generates brand new keys for end-users with create_api_key, or provisions temporary tokens for testing machine calls using create_access_token. When a key needs adjusting, you can modify its scope or details with update_api_key, and if it's stale, you delete it instantly with delete_api_key.

To keep tabs on usage, your agent pulls consumption data via get_api_key_usage and retrieves a list of all active keys using get_active_api_keys. You can also check key status in real-time by running the validate_api_key tool.

When you need to audit access or find specific records, your agent has multiple lookup options. You can pull every detail about a user with get_user, or list everyone belonging to a tenant using get_users_in_org. For deeper reads, you can check current OAuth tokens associated with an account via get_oauth_tokens and get the complete details for any organization with get_org.

You'll also find tools that let you query users and organizations in bulk, supporting filtering and pagination through query_users and query_orgs, respectively. For roles, you can fetch definitions of custom roles used across the platform by calling get_custom_role_mappings or linking a tenant to these structures with subscribe_org_to_mapping. Finally, if a user needs to log in without a password, your agent generates a unique, time-sensitive magic link using create_magic_link, and you can refresh an expired provider token for any account using refresh_provider_token.