Agentgateway Authentication

generated: '2026-08-30'
method: searched
source: https://agentgateway.dev/docs/standalone/latest/configuration/security/ (jwt-authn, apikey-authn, basic-authn, oidc, mcp-authn, mcp-authz, external-authz, backend-authn/*) + https://agentgateway.dev/docs/standalone/latest/operations/debug/
provider: AgentGateway
providerId: agentgateway
description: >-
  Authentication for agentgateway has two distinct sides and they must not be conflated. (1) The
  ADMIN/DEBUG API this repo describes in openapi/ has NO authentication at all - it is protected by
  binding to loopback. (2) The gateway's DATA PLANE offers a rich inbound and backend authentication
  toolkit that YOU configure for the traffic passing through. Nothing here is a credential you obtain
  from agentgateway; there is no account, no key issuance, no signup.
admin_api:
  schemes: []
  authentication: none
  transport_protection: loopback-bind
  default_bind: 127.0.0.1:15000
  configurable_via: adminAddr
  applies_to:
    - openapi/agentgateway-config-api-openapi.yml
    - openapi/agentgateway-debug-api-openapi.yml
    - openapi/agentgateway-lifecycle-api-openapi.yml
    - openapi/agentgateway-logging-api-openapi.yml
    - openapi/agentgateway-memory-api-openapi.yml
    - openapi/agentgateway-profiling-api-openapi.yml
  source: https://agentgateway.dev/docs/standalone/latest/operations/debug/
  note: >-
    Verbatim from the docs: "The admin interface binds to the loopback interface, so only a client on
    the same host can reach it. Keep it that way. Endpoints such as /quitquitquit and /config_dump shut
    down the proxy and dump its full configuration to any caller that can open a connection." The
    security model is network placement, not a credential. A derived securityScheme block would be a
    fabrication - derive-authentication.py correctly produced zero profiles for this repo.
data_plane_inbound:
  description: Authentication policies agentgateway can enforce on traffic arriving at a listener or route.
  methods:
    - id: jwt
      name: JWT authentication
      type: http-bearer
      attaches_to: [listener, route]
      docs: https://agentgateway.dev/docs/standalone/latest/configuration/security/jwt-authn/
      detail: >-
        Validates a bearer JWT against a JWKS URL. Fields: issuer, audiences, jwks, requiredClaims
        (default ["exp"]). Since 1.5.0 the `iss` claim is REQUIRED when `issuer` is set, and `aud` is
        REQUIRED when `audiences` is a non-empty list - a behaviour change that rejects tokens that
        previously passed. Verified claims are exposed to later policies as the CEL `jwt.*` context.
    - id: apikey
      name: API key authentication
      type: apiKey
      attaches_to: [listener, route]
      docs: https://agentgateway.dev/docs/standalone/latest/configuration/security/apikey-authn/
      detail: >-
        Keys carry metadata that later policies can read via the CEL `apiKey` context (for example to
        set an x-authenticated-user header). Keys created in the admin UI or through the admin API
        carry agentgateway-managed metadata under the reserved `agentgateway.dev/` prefix - since
        1.5.0 the identifier moved from metadata.id to metadata["agentgateway.dev/id"], a new
        metadata["agentgateway.dev/createdAt"] was added, and user-supplied fields using that prefix
        are rejected. API keys also carry LLM budgets and per-key model access lists.
    - id: basic
      name: Basic authentication
      type: http-basic
      attaches_to: [listener, route]
      docs: https://agentgateway.dev/docs/standalone/latest/configuration/security/basic-authn/
    - id: oidc
      name: OIDC browser authentication
      type: openIdConnect
      attaches_to: [route]
      docs: https://agentgateway.dev/docs/standalone/latest/configuration/security/oidc/
      detail: Interactive browser login, also the documented way to put a login in front of the agentgateway UI.
    - id: mcp-authn
      name: MCP authentication
      type: oauth2
      attaches_to: [route]
      docs: https://agentgateway.dev/docs/standalone/latest/configuration/security/mcp-authn/
      detail: >-
        Applies the MCP authorization spec in front of a fronted MCP server. Returns 401 Unauthorized
        with a WWW-Authenticate header to unauthenticated callers, and SERVES the discovery documents
        the client then fetches - /.well-known/oauth-protected-resource/{path} (RFC 9728) and
        /.well-known/oauth-authorization-server/{path} (RFC 8414), plus a proxied dynamic client
        registration endpoint (RFC 7591) where the identity provider needs one. Modes: `strict`
        (default, a valid token from a configured issuer is required) and permissive variants.
        Provider adapters exist for auth0, authentik, descope, keycloak and okta; Okta requires an
        explicit `jwks` because it publishes keys at {issuer}/v1/keys.
    - id: mcp-authz
      name: MCP authorization
      type: policy
      attaches_to: [route, backend]
      docs: https://agentgateway.dev/docs/standalone/latest/configuration/security/mcp-authz/
      detail: Per-tool authorization over MCP method calls, evaluated after authentication.
    - id: external-authz
      name: External authorization (ext_authz)
      type: delegated
      attaches_to: [listener, route, backend]
      docs: https://agentgateway.dev/docs/standalone/latest/configuration/security/external-authz/
      detail: Delegates the allow/deny decision to an external policy server.
    - id: network-authz
      name: Network authorization
      type: l4-acl
      attaches_to: [frontend]
      docs: https://agentgateway.dev/docs/standalone/latest/configuration/security/network-authz/
      detail: L4 transport-level access control, applied before HTTP policy.
data_plane_backend:
  description: How agentgateway authenticates ITSELF to the upstreams it proxies to.
  methods:
    - id: static-key
      name: Static keys and passthrough
      docs: https://agentgateway.dev/docs/standalone/latest/configuration/security/backend-authn/key/
    - id: jwt-sign
      name: Signed JWT assertion (jwtSign)
      docs: https://agentgateway.dev/docs/standalone/latest/configuration/security/backend-authn/jwt-sign/
      detail: For upstreams that refuse a durable credential, such as Snowflake.
    - id: oauth-token-exchange
      name: OAuth token exchange (RFC 8693)
      docs: https://agentgateway.dev/docs/standalone/latest/configuration/security/backend-authn/oauth-token-exchange/
    - id: cross-app-access
      name: Cross App Access (ID-JAG)
      docs: https://agentgateway.dev/docs/standalone/latest/configuration/security/backend-authn/cross-app-access/
    - id: aws
      name: AWS SigV4 request signing
      docs: https://agentgateway.dev/docs/standalone/latest/configuration/security/backend-authn/providers/aws/
    - id: gcp
      name: Google Cloud credentials
      docs: https://agentgateway.dev/docs/standalone/latest/configuration/security/backend-authn/providers/gcp/
    - id: azure
      name: Microsoft Entra ID token
      docs: https://agentgateway.dev/docs/standalone/latest/configuration/security/backend-authn/providers/azure/
    - id: copilot
      name: GitHub Copilot token
      docs: https://agentgateway.dev/docs/standalone/latest/configuration/security/backend-authn/providers/copilot/
    - id: backend-tls
      name: Backend TLS
      docs: https://agentgateway.dev/docs/standalone/latest/configuration/security/backend-tls/
    - id: spiffe
      name: SPIFFE workload identity mTLS
      docs: https://github.com/agentgateway/agentgateway/tree/main/examples/traffic-spiffe
scopes:
  applicable: false
  note: >-
    Agentgateway issues no OAuth scopes of its own. Scopes belong to whichever identity provider a
    deployment configures; agentgateway validates the resulting token. No scopes/ artifact is written -
    an empty scope registry would misrepresent the product.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com