The differentiator · Identity
Emulated authentication: per-user identity, without OAuth.
The end user never logs into the assistant. A webhook identity bridge lets the AI act on behalf of each person — even in legacy systems that never had OAuth.
What it is
A simple identity bridge, via webhook, between the assistant and your system. Your software already knows your users; BIOS just asks who is who and receives a token specific to that user.
The flow
Four steps, from channel to operation
Message
A user sends a message over a channel — for example, WhatsApp.
Webhook call
The assistant calls your endpoint, sending the channel, the user identifier, and the Verification Key.
Resolution
Your system resolves who the user is and returns an authentication token for them.
Operation
The AI executes on your API as that user, with their permissions.
Bridge security
The Verification Key alone authenticates nothing
HMAC signature
Every call carries HMAC with a timestamp and nonce, preventing replay.
Proof of possession
The first user↔channel binding requires verification (e.g., OTP), since the identifier is spoofable.
Key rotation
Verification Keys and webhook secrets rotatable from the dashboard, with history.
Step-up
Sensitive operations require explicit user confirmation in the chat before executing.
Identity resolved where OAuth never reached.
Book a demo and validate the bridge with your system.
Talk to BIOS · WhatsApp