One identity. Seven capabilities.

Every Loomal identity is a capability hub. Attach what your agent needs — email, encrypted credentials, 2FA, voice, payments, social, messaging. Everything scoped to a single identity, fully auditable, and instantly revocable. Revoke the identity, and every capability shuts off.

Inbox

A real email address your agent owns.
sales-x8k2m@mailgent.dev
Not a forwarding alias or shared inbox — a dedicated mailbox with its own address. Full send, receive, and threading with automatic In-Reply-To stitching. Every outbound email is DKIM-signed with agent identity headers. Inbound messages include extractedText that strips quoted reply history, so your LLM gets clean content without noise.

  • Inbound delivery: < 200ms
  • DKIM: Signed outbound
  • Threads auto-stitched
const msg = await mg.messages.send({
  to: "lead@company.com",
  subject: "Following up",
  text: aiResponse,
})

Vault

Encrypted credential storage for agents.
vault.store({ label, value })
Stop hardcoding secrets in .env files. Store API keys, OAuth tokens, and login credentials with AES-256-GCM envelope encryption — per-credential data encryption keys wrapped by org-level KMS keys. Every credential is scoped to a specific identity with a full audit trail on every read. OAuth tokens are automatically refreshed before expiry. Rotate API keys with zero downtime. Import existing secrets by dragging a .env file into the console.

  • Encryption: AES-256
  • Auto OAuth refresh
  • Per-key audit trail
await mg.vault.store({
  label: "stripe-key",
  type: "api_key",
  value: "sk_live_...",
  service: "stripe",
})

TOTP

2FA codes so your agent can log in anywhere.
totp.generate("github-2fa")
Store TOTP seeds once, generate valid 6-digit codes on demand via the API. Seeds are stored encrypted and never returned — only the time-limited codes are accessible. Combined with email-based 2FA (your agent already has an inbox), Loomal agents can complete virtually any authentication flow that a human with a phone could handle — autonomously, with no human in the loop.

  • Code generation: 6-digit
  • Rotation window: 30s
  • Email+ Dual 2FA
const code = await mg.totp.generate("github-2fa")
// => "349281"  (valid for 30s)

Four more capabilities on the way.

  • Voice: Give your agent a phone number. Make and receive calls, send SMS, transcribe voicemails — all tied to the same identity.
  • Pay: Attach payment methods with per-transaction spending limits and merchant restrictions. Agents can pay for services without exposing your card.
  • Social: Managed social media accounts on X, LinkedIn, and more. Post, reply, and engage — with full audit trails and revocable access.
  • Messaging: WhatsApp, Telegram, Slack, and Discord accounts for your agent. Same identity, every channel your users are on.

Why Loomal

Built different.

Other platforms give agents tools. Loomal gives agents identity — a single, verifiable presence that persists across every service they touch.

  • Identity-first architecture: Every capability is scoped to an identity with a delegation chain. Trace any agent action back to the human who authorized it. Revoke the identity and everything stops.
  • One API, not twelve: Email, vault, and TOTP through a single REST API and native MCP server. No stitching together SendGrid, AWS Secrets Manager, and a TOTP library. One key, one integration.
  • Standards, not protocols: Built on DKIM, SPF, DMARC, OAuth 2.1, and MCP. No proprietary agent-to-agent protocol to adopt. Works with LangChain, CrewAI, AutoGen, Vercel AI SDK, and any HTTP client.

Give your agent an identity.

Create an identity, attach capabilities, and start building.