Multi-client authentication
Isolate credentials per client and enforce route-level access control.
As your ecosystem grows, managing access across multiple clients, partners, and services becomes increasingly complex. Shared credentials introduce security risks, limited visibility, and operational friction.
What you can do
- Assign unique API keys per client, partner, or application.
- Protect specific routes and services independently.
- Support multiple authentication headers, especially for MCP-based integrations.
How it works
Define access controls at the gateway layer and map credentials to specific routes or services. Each client operates in an isolated authentication context.
For implementation details, see Configure API key authentication.
Related
- Configure API key authentication: Step-by-step guide to enabling API key source authentication on a surface.
- OPA policies: How gateway and surface policies enforce route-level access control.
Was this page helpful?
Glad to hear it! Please tell us how we can improve more.
Sorry to hear that. Please tell us how we can improve.
Thank you for sharing your feedback so we can improve your experience.