ScrambleID is a passwordless authentication company that proves who is acting, whether a person or an AI agent, using cryptography instead of passwords. It is aimed at organisations that need strong verification across many channels, from the web and call centres to shared frontline devices, and that want an auditable record of who approved what.
The platform sits on top of the identity provider a company already runs, so nothing has to be replaced, and it gives people and agents the same kind of verifiable, tamper-evident identity.
At A Glance
| Vendor | ScrambleID (ScrambleID, Inc.) |
|---|---|
| Category | Passwordless authentication and agent identity |
| Identities covered | Workforce users, callers, frontline workers, AI agents |
| Deployment | Managed multi-tenant cloud service, with dedicated tenancy for regulated customers |
| Agentic AI | Per-call signed identity for AI agents |
| Market classification | Workforce IAM |
What ScrambleID Does
Passwords can be phished and log entries can be edited, so neither really proves who did something. ScrambleID replaces both with cryptographic proof that a specific person or agent acted and that the record has not been changed since.
At the centre is a Dynamic Identifier rather than a username: a short-lived, single-use identifier bound to a key held in hardware. The same identity model, trust-zone model and audit chain apply whether the actor is an employee, a caller or an AI agent, and everything connects to the existing IdP over OIDC or SAML 2.0.
Products
Humans
Humans is for organisations that need to verify people wherever they interact, not only at a web login.
| Voice | The IVR reads out a code and the caller enters it in the ScrambleID app. |
|---|---|
| Web | Sign-in with a QR code or passkeys, confirmed by a biometric on the device. |
| People | Two parties open the app and exchange codes to prove to each other who they are. |
| Frontline | Passwordless sign-in for shared devices, layered over shared-account POS, EHR and workstation systems without migrating them, and built to meet PCI 8.4.2, HIPAA and EPCS requirements. |
Agents
Agents is for teams deploying AI agents that call APIs and other services and who need to know which agent made a call and which person is answerable for it. Each agent gets its own verifiable identity tied back to a named human owner, so agent activity can be audited and revoked through its owner.
Actions
Actions puts a gate and a proof on every consequential action so there is a signed record of who approved it. It is in early access.
How It Works
| Component | What it does |
|---|---|
| On-device keys | A biometric unlocks a cryptographic key in the device’s secure enclave. The private key stays on the device and only signed assertions are sent. |
| Intent | Approvals are signed per action, and above a policy threshold a second person can be required to co-sign. |
| Proof and audit chain | Each authentication record is signed by the Verification Service and by the customer’s own key, and records are chained so any edit is detectable. Customers can check signatures and chain links offline with the scramble-audit-verify CLI. |
| Signing speed | Local signing takes a reported under 100ms on modern phones and workstations. |
| Deployment | The service is managed and multi-tenant by default, with dedicated tenancy for regulated customers. |
Identities And Systems Covered
| Human users | Workforce and customer authentication over web, voice and peer-to-peer channels. |
|---|---|
| Frontline workers | Staff signing in on shared devices. |
| AI agents | Per-call signed identity bound to a registered human owner. |
Agentic AI Capabilities
Per-Call Agent Signatures
Every agent call is signed at the moment it is made with an ephemeral key bound to the runtime. The signed payload carries the agent’s identity, its registered owner and a runtime fingerprint.
Owner Revocation And Federation
Revoking the owner makes every downstream signature fail verification, and a verifier failure blocks the call by default. Agent identity can come from an IdP’s principal model, agents from different organisations can verify each other through federated trust roots, and identity bindings live in the same repository as the agent code.
Integrations
| Area | Integrations |
|---|---|
| Identity providers | Okta, Entra ID, Ping, ForgeRock, Auth0 |
| Contact centre (voice) | NICE, Twilio, Google CCAI |
| Identity governance | SailPoint, Saviynt (provisioning and de-provisioning) |
Company Background
| Company | ScrambleID, Inc. |
|---|---|
| Scale | More than 2.5 million reported users. |
| Security | SOC 2 Type II. |
| Availability | AWS Marketplace. |
Note: This overview is compiled from ScrambleID’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.