The enterprise stack, configured for your desk.
SSO, roles, per-agent identity, and a signed audit trail — deployed, not hand-rolled. Connect your identity provider, assign roles, and your team is live.
# connect once, your desk is live
workspace:
name: "your-fund"
sso:
provider: oidc
issuer: "https://login.yourfund.com"
roles: [owner, security_admin, member]
agents:
# every agent below gets its own key — none shared
- signals-desk
- execution-desk
# audit trail: signed, chained, verifiable at /receipt-keysWhat your desk gets, not what you have to build.
The same enterprise identity and security backbone described on our Enterprise plan — deployed for your team, configured in an afternoon.
Enterprise SSO for your desk
Point us at your identity provider — Okta, Azure AD, Google Workspace, or any OIDC issuer — and sign-in follows your existing setup. Roles and SCIM deprovisioning mean access is never a manual step.
Every agent, its own identity
Your signals desk's feed, your execution desk's trading agent, a research assistant — each one is issued its own signing key. Nothing is shared, so compromising one never touches the rest of the fleet.
Delegation with a paper trail
A head of desk grants a capability to an orchestrator; the orchestrator hands a narrower slice to a specialist agent. Every hand-off is on the record, so any action traces back to who authorized it.
One switch for the whole team
Someone leaves, a key looks wrong, a vendor is compromised — revoke at the workspace and every token, key, and delegation tied to it goes stale immediately, not at its next expiry.
A signed, checkable record
Every fund-affecting action produces an Ed25519-signed receipt, chained to the one before it. Compliance can verify it against our published key at /receipt-keys instead of trusting a dashboard. Read Fexr's infrastructure classification under FATF Recommendation 15 →
One seat, the whole fleet
Every agent your desk runs draws on the same Enterprise seat — no per-agent billing to provision, meter, or reconcile as your team grows.
Four steps, not a sprint.
Rolling out enterprise identity isn't a development project. There's no code to write — just your IdP, your org chart, and your agents.
Connect your IdP
OIDC issuer, sign-in works the same day
Assign roles
Owner to auditor, mapped to your org chart
Register your agents
Every strategy and signal feed gets its own key
Go live, audited from day one
The receipt chain starts the moment the first agent does
# connect your IdP — this is the whole integration
sso:
provider: oidc
issuer: "https://login.yourfund.com"
client_id: "fexr-workspace"
roles:
security_admin: ["[email protected]"]
billing_admin: ["[email protected]"]
member: group:"trading-desk"
# no custom code requiredYour identity provider, your alerting, your audit tools.
Nothing here is Fexr-proprietary. If your desk already uses it, it plugs straight in.
Identity Providers
Okta, Azure AD, Google Workspace
Connected over OIDC — sign-in follows the directory you already run.
Any OIDC Issuer
Auth0, PingIdentity, your own IdP
Not locked to a named vendor. Any standard OIDC issuer works.
Audit & SIEM Export
Splunk, Datadog, your SIEM
Export the signed receipt chain for independent review.
Team Alerts
Slack, Telegram, email
Route security and trading alerts to where your desk already watches.
No integration required. One is still there if you want it.
Most desks configure everything from the dashboard and never see a line of code. The API stays available for teams that want it.
Dashboard, zero code
Configure SSO, assign roles, register agents, and read the audit trail — entirely from the dashboard. This is the path most teams take.
Identity is the integration
For most teams, the entire rollout is the SSO connection from step one. There's no second system to wire up afterward.
Available, never required
Quants who want programmatic access get the full REST and MCP surface — the same auth model, the same per-agent identity, nothing dashboard-only.
JS today. More on request.
The JavaScript/TypeScript SDK is public now — npm install fexr, or see it on npm. Python, Rust, Dart, and a CLI are built and running internally — we release them to teams as the need comes up, not on a fixed roadmap.
Go deeper.
Frequently Asked Questions From Teams & Funds
Common questions from desks rolling out Fexr.
01.What does a team or fund need to build to use Fexr?
For most teams, nothing. Connect your identity provider, assign roles, and the desk is live — SSO, per-agent identity, and the signed audit trail are already built. The API and SDKs stay available for teams that do want programmatic access.
02.How does enterprise SSO work?
Sign in through your own identity provider over OIDC — Okta, Azure AD, Google Workspace, or any standard OIDC issuer. Roles and deprovisioning follow your IdP automatically through SCIM.
03.Does every agent our desk runs get its own credential?
Yes. Every agent — a strategy, a signal feed, a goal session — carries its own signing key. Nothing is shared across your fleet, so revoking one agent never touches the rest.
04.Can compliance verify the audit trail independently?
Yes. Every fund-affecting action produces an Ed25519-signed receipt chained to the one before it, verifiable against our published key at /receipt-keys — not something you have to take on trust.
Let's get your desk live.
Talk to us about your team's setup. Most desks are live within a week — no integration project required.
Explore Further
- API Documentation — unlock secure endpoints in under an hour
- Enterprise Plan — SSO, per-agent identity, and signed receipts, in full
- Agentic Safety — the checks on every action before it executes
- Fexr LLM Skills — give your agents a typed contract instead of a guess