The stack stopped being one vendor
Identity verification, authentication, fraud, risk and provisioning come from different providers. Every combination is an integration, and every integration is code somebody has to own.
Visual Identity OrchestratorDesign the identity journey.
Design the identity journey.
Don't code it.
A drag-and-drop canvas for every phase of the identity lifecycle — provisioning, authentication, authorization, governance. Model the flow, connect the systems, change it when the business changes. No release required.
Why orchestration
Identity stopped being a product and became a process
Three shifts turned journey orchestration from a feature into a category of its own.
The journey changes faster than the release cycle
Risk rules, regulation and conversion targets move monthly. When the journey lives inside application code, changing it means a development cycle for what is essentially a policy decision.
Orchestration is being absorbed into CIAM suites
Most orchestration capability now ships inside a customer identity platform. That is fine — until you have to adopt the whole platform to get it. Orchestration should be adoptable on its own.
Monokee takes the third one seriously: the orchestrator is the product, not a feature you unlock by migrating your whole identity stack.
How it works
Four moves, one canvas
From a blank diagram to journeys running in front of your applications. Each move is something you do once and then keep changing, because none of it is compiled into an application you would have to release again.
01Design
Draw the journey
Every path a user can take, on one diagram.
Registration, login, step-up, consent, password reset, account recovery, offboarding: each one becomes a sequence of blocks you place and connect. The branches are explicit — what happens when the device is unknown, when a credential has expired, when a risk score crosses its threshold. Because the flow is a picture rather than a call stack, the people who own the process can read it: fraud, compliance, product, not only the developers who used to be the only ones who could see it.
- Blocks for every phase of the identity lifecycle
- Conditional branches, loops and nested flows
- Reviewable by people who do not write code
02Connect
Plug in the tools you already use
The integration work moves out of your applications.
MFA providers, identity verification and KYC services, antifraud engines, risk scoring, cloud directories and just-in-time provisioning all land on the canvas as nodes. The orchestrator holds the protocol details, the token exchange and the error handling; your applications keep talking to a single endpoint and never learn which vendor is behind it. Replacing a provider becomes an edit to a diagram instead of a change to production code in every application that touched it.
- SAML 2.0, OpenID Connect, OAuth 2.0, SCIM, LDAP and WebAuthn out of the box
- Antifraud, risk scoring and KYC services as first-class nodes
- Swap a provider without redeploying the applications
03Distribute
Run it across domains
One journey, many organisations.
The same flow can be published to separate brands, subsidiaries, tenants or departments, each with its own identity providers, branding and local rules, while the parts that are genuinely shared stay shared. A change to the common trunk reaches everyone; a local exception stays local instead of forking into a second flow that slowly drifts out of sync. Multi-domain stops being a migration project and becomes a property of the flow itself.
- Separate domains with their own identity providers and branding
- A shared trunk with deliberate local exceptions
- No duplicated copies of the same journey to keep aligned
04Enforce
Bind it to the applications
Each application gets the assurance it actually needs.
A flow is attached to a specific application, API or transaction, so the amount of proof asked of the user matches what is at stake. A high-value payment can demand a fresh biometric factor; a routine read stays frictionless and invisible. When the risk picture changes — a new regulation, a fraud pattern, a conversion problem — you point the application at a different flow. No release, no redeployment, no code.
- Per-application and per-API flow binding
- Step-up only where the risk justifies the friction
- Change the assurance level without a release cycle
What the canvas orchestrates nextToday Today Today Emerging Emerging Emerging
The surface keeps widening
Digital identity is being reshaped by agentic AI, portable credentials and continuous, event-driven trust. An orchestrator is where those pieces get connected — so it is worth being explicit about what is here today and what is still arriving.
Verifiable credentials and wallets
W3C verifiable credentials and external digital wallets can be issued, requested and verified as steps inside a journey — the same canvas that already handles passwords and passkeys.
Adaptive, context-aware access
Access decisions combine user attributes, device posture, location and reputation signals, evaluated continuously rather than once at login.
Standards over proprietary glue
SAML 2.0, OpenID Connect, OAuth 2.0, SCIM, LDAP and WebAuthn are native. What is standard stays portable; what is proprietary stays replaceable.
Identities for AI agents
Agents acting on behalf of people need their own identity, scoped and short-lived credentials, and an auditable link back to the human who authorised them. Orchestration is where that delegation gets designed.
Continuous session signals
Event-based frameworks let risk and session signals be shared between systems in real time, so a session can be re-evaluated or ended the moment something changes — not at the next login.
Externalised authorization
Fine-grained authorization is moving out of applications and behind a standard interface, so policy can be written once and enforced everywhere.
Bring us a journey you can't change quickly enough
We'll model it on the canvas with you and show you what it takes to run it.
Talk to an expert